Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e70958862a38aa90ff6a0402938b187faa991d2740b886322f8fc1b8cda0c9f.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target 5e70958862a38aa90ff6a0402938b187faa991d2740b886322f8fc1b8cda0c9f.dll
- Size 120KB
- Sample240611-2edxtavajd
- SHA256 5e70958862a38aa90ff6a0402938b187faa991d2740b886322f8fc1b8cda0c9f
- MD5 d850de412afb627334677014ea329347
- SHA1 cbaf65de00d02d6c35c78c36c649abe64e0c7777
- SHA512 594304b68e86338402d1cb501bbd8f010674370e3ade2834d1a538ade1e509be632ed41012fd93f229c10a6828c929708ca302c90ce9c96a2d70706988fb8536
- SSDEEP 3072:RsMv02BnQlUS7M9Hmw56S323j5ay7/tDrbe:KMs2BnQOS7M9Gw4W23j5JZDr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577fcf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5765ce.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5763fa.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 33 IoCs
resource yara_rule behavioral2/memory/4640-9-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-12-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-25-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-23-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-13-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-24-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-10-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-8-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-6-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-30-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-37-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-36-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-38-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-39-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-40-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-42-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-43-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-52-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-54-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-55-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-65-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-67-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-70-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-71-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-73-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-74-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-75-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-79-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-80-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-81-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4640-84-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1136-118-0x0000000000B20000-0x0000000001BDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1136-131-0x0000000000B20000-0x0000000001BDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 38 IoCs
resource yara_rule behavioral2/memory/4640-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4640-9-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-12-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1136-35-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4640-25-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-23-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-13-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-24-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-10-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-8-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-6-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-30-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-37-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-36-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-38-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-39-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-40-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-42-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-43-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-52-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-54-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-55-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-65-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-67-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-70-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-71-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-73-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-74-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-75-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-79-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-80-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-81-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-84-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4640-101-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1136-118-0x0000000000B20000-0x0000000001BDA000-memory.dmp UPX behavioral2/memory/1136-131-0x0000000000B20000-0x0000000001BDA000-memory.dmp UPX behavioral2/memory/1136-132-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4896-153-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4640 e5763fa.exe 1136 e5765ce.exe 4896 e577fcf.exe -
resource yara_rule behavioral2/memory/4640-9-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-12-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-25-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-23-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-13-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-24-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-10-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-8-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-6-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-30-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-37-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-36-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-38-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-39-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-40-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-42-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-43-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-52-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-54-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-55-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-65-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-67-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-70-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-71-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-73-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-74-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-75-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-79-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-80-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-81-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4640-84-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1136-118-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1136-131-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577fcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5763fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5765ce.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577fcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5763fa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577fcf.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e5763fa.exe File opened (read-only) \??\K: e5763fa.exe File opened (read-only) \??\L: e5763fa.exe File opened (read-only) \??\N: e5763fa.exe File opened (read-only) \??\G: e5763fa.exe File opened (read-only) \??\I: e5763fa.exe File opened (read-only) \??\P: e5763fa.exe File opened (read-only) \??\Q: e5763fa.exe File opened (read-only) \??\E: e5763fa.exe File opened (read-only) \??\H: e5763fa.exe File opened (read-only) \??\M: e5763fa.exe File opened (read-only) \??\O: e5763fa.exe File opened (read-only) \??\R: e5763fa.exe File opened (read-only) \??\S: e5763fa.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e5763fa.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5763fa.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5763fa.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5763fa.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e576448 e5763fa.exe File opened for modification C:\Windows\SYSTEM.INI e5763fa.exe File created C:\Windows\e57b47b e5765ce.exe File created C:\Windows\e57ceba e577fcf.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4640 e5763fa.exe 4640 e5763fa.exe 4640 e5763fa.exe 4640 e5763fa.exe 1136 e5765ce.exe 1136 e5765ce.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe Token: SeDebugPrivilege 4640 e5763fa.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 2152 3244 rundll32.exe 82 PID 3244 wrote to memory of 2152 3244 rundll32.exe 82 PID 3244 wrote to memory of 2152 3244 rundll32.exe 82 PID 2152 wrote to memory of 4640 2152 rundll32.exe 83 PID 2152 wrote to memory of 4640 2152 rundll32.exe 83 PID 2152 wrote to memory of 4640 2152 rundll32.exe 83 PID 4640 wrote to memory of 792 4640 e5763fa.exe 8 PID 4640 wrote to memory of 800 4640 e5763fa.exe 9 PID 4640 wrote to memory of 380 4640 e5763fa.exe 13 PID 4640 wrote to memory of 2720 4640 e5763fa.exe 49 PID 4640 wrote to memory of 2728 4640 e5763fa.exe 50 PID 4640 wrote to memory of 2960 4640 e5763fa.exe 51 PID 4640 wrote to memory of 3520 4640 e5763fa.exe 56 PID 4640 wrote to memory of 3644 4640 e5763fa.exe 57 PID 4640 wrote to memory of 3840 4640 e5763fa.exe 58 PID 4640 wrote to memory of 4012 4640 e5763fa.exe 59 PID 4640 wrote to memory of 4072 4640 e5763fa.exe 60 PID 4640 wrote to memory of 3872 4640 e5763fa.exe 61 PID 4640 wrote to memory of 4124 4640 e5763fa.exe 62 PID 4640 wrote to memory of 392 4640 e5763fa.exe 64 PID 4640 wrote to memory of 2292 4640 e5763fa.exe 75 PID 4640 wrote to memory of 228 4640 e5763fa.exe 79 PID 4640 wrote to memory of 3244 4640 e5763fa.exe 81 PID 4640 wrote to memory of 2152 4640 e5763fa.exe 82 PID 4640 wrote to memory of 2152 4640 e5763fa.exe 82 PID 2152 wrote to memory of 1136 2152 rundll32.exe 84 PID 2152 wrote to memory of 1136 2152 rundll32.exe 84 PID 2152 wrote to memory of 1136 2152 rundll32.exe 84 PID 2152 wrote to memory of 4896 2152 rundll32.exe 88 PID 2152 wrote to memory of 4896 2152 rundll32.exe 88 PID 2152 wrote to memory of 4896 2152 rundll32.exe 88 PID 4640 wrote to memory of 792 4640 e5763fa.exe 8 PID 4640 wrote to memory of 800 4640 e5763fa.exe 9 PID 4640 wrote to memory of 380 4640 e5763fa.exe 13 PID 4640 wrote to memory of 2720 4640 e5763fa.exe 49 PID 4640 wrote to memory of 2728 4640 e5763fa.exe 50 PID 4640 wrote to memory of 2960 4640 e5763fa.exe 51 PID 4640 wrote to memory of 3520 4640 e5763fa.exe 56 PID 4640 wrote to memory of 3644 4640 e5763fa.exe 57 PID 4640 wrote to memory of 3840 4640 e5763fa.exe 58 PID 4640 wrote to memory of 4012 4640 e5763fa.exe 59 PID 4640 wrote to memory of 4072 4640 e5763fa.exe 60 PID 4640 wrote to memory of 3872 4640 e5763fa.exe 61 PID 4640 wrote to memory of 4124 4640 e5763fa.exe 62 PID 4640 wrote to memory of 392 4640 e5763fa.exe 64 PID 4640 wrote to memory of 2292 4640 e5763fa.exe 75 PID 4640 wrote to memory of 1136 4640 e5763fa.exe 84 PID 4640 wrote to memory of 1136 4640 e5763fa.exe 84 PID 4640 wrote to memory of 4652 4640 e5763fa.exe 86 PID 4640 wrote to memory of 2132 4640 e5763fa.exe 87 PID 4640 wrote to memory of 4896 4640 e5763fa.exe 88 PID 4640 wrote to memory of 4896 4640 e5763fa.exe 88 PID 1136 wrote to memory of 792 1136 e5765ce.exe 8 PID 1136 wrote to memory of 800 1136 e5765ce.exe 9 PID 1136 wrote to memory of 380 1136 e5765ce.exe 13 PID 1136 wrote to memory of 2720 1136 e5765ce.exe 49 PID 1136 wrote to memory of 2728 1136 e5765ce.exe 50 PID 1136 wrote to memory of 2960 1136 e5765ce.exe 51 PID 1136 wrote to memory of 3520 1136 e5765ce.exe 56 PID 1136 wrote to memory of 3644 1136 e5765ce.exe 57 PID 1136 wrote to memory of 3840 1136 e5765ce.exe 58 PID 1136 wrote to memory of 4012 1136 e5765ce.exe 59 PID 1136 wrote to memory of 4072 1136 e5765ce.exe 60 PID 1136 wrote to memory of 3872 1136 e5765ce.exe 61 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5763fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5765ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577fcf.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2728
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2960
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e70958862a38aa90ff6a0402938b187faa991d2740b886322f8fc1b8cda0c9f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e70958862a38aa90ff6a0402938b187faa991d2740b886322f8fc1b8cda0c9f.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\e5763fa.exeC:\Users\Admin\AppData\Local\Temp\e5763fa.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\e5765ce.exeC:\Users\Admin\AppData\Local\Temp\e5765ce.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1136
-
-
C:\Users\Admin\AppData\Local\Temp\e577fcf.exeC:\Users\Admin\AppData\Local\Temp\e577fcf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:4896
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3644
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3840
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4072
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3872
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:392
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2292
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:228
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4652
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2132
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5763fa.exe
- Size 97KB
- SHA256 2be6effb0c0744cb34000e614535505f467df40ec3ac00c47f780b64f2bc89f6
- MD5 981c32cd34a5cb1d89aa799dbce61452
- SHA1 1e918edd0e1fc32259b3955ee2c68f57734166be
- SHA512 9955c971140105e3035554401ee6ea679362b03420cdbfd981419bb1c3f9f3d55402693778d4d697297707b69fb50484aefacf05ecdae8454829ca0e3320b194
- SSDEEP 1536:eUz/rFA+lyyX4WW+YGc47oYJgVa9+I7Ep+KdRt6:jCeyoY2kY+89+wEYMRt6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 87d041a71023c7baedc0425284a9323533ea7e308fe113814caca5d0a68f74fb
- MD5 00ae24371c881f5a1b7c1e37dd86b761
- SHA1 1a02c59d15ca7906950d2331a5317f96785a2f10
- SHA512 c5bb7b6e7d1eb4bd1b74ba88713b8c0a8d27ba00aa78fc759d1731db6ac5ce9ed4f363c0f9578c76562926cf9971a209029b4c6c0a82f423830b255a9c542ec1
- MD5 SHA1 SHA512