Analysis
- max time kernel
147s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cdf8e2fca3c6b0e8bad30203b0cf148da5ec734e9914d5556e0745cc5f379dfe.dll
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
General
- Target cdf8e2fca3c6b0e8bad30203b0cf148da5ec734e9914d5556e0745cc5f379dfe.dll
- Size 120KB
- Sample240611-dwzzlsshqj
- SHA256 cdf8e2fca3c6b0e8bad30203b0cf148da5ec734e9914d5556e0745cc5f379dfe
- MD5 31465951834ea3ac17c28277244e72d6
- SHA1 886ba49e96903eb21d56ed4ca610be8967e1aa0f
- SHA512 1013d1a707f9cef89e254924482b28068faa282205b7a26d5956e00113cc70f2d71fbd7a90682ed4168cba8177d4c7eb9dc9edcf8622adf246c722c6dfffcec9
- SSDEEP 3072:smv/5DNAFPhBwl5XUKLP0KRVNZceqfAT/aOhOb2HnPygf4:su3i/KLnVceqfAT/aB2vyi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57689d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57689d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57689d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574ce7.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 33 IoCs
resource yara_rule behavioral2/memory/2792-6-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-8-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-11-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-10-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-9-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-12-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-24-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-29-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-32-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-33-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-34-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-35-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-36-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-37-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-38-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-39-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-41-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-42-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-52-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-53-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-54-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-64-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-66-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-69-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-71-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-73-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-76-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-78-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-84-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-85-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2792-87-0x00000000007E0000-0x000000000189A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3524-122-0x0000000000B20000-0x0000000001BDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3524-152-0x0000000000B20000-0x0000000001BDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 36 IoCs
resource yara_rule behavioral2/memory/2792-6-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-8-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-11-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-10-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-9-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-12-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-24-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-29-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-32-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-33-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-34-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-35-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-36-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-37-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-38-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-39-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-41-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-42-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-52-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-53-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-54-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-64-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-66-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-69-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-71-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-73-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-76-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-78-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-84-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-85-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-87-0x00000000007E0000-0x000000000189A000-memory.dmp UPX behavioral2/memory/2792-106-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2184-110-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3524-122-0x0000000000B20000-0x0000000001BDA000-memory.dmp UPX behavioral2/memory/3524-152-0x0000000000B20000-0x0000000001BDA000-memory.dmp UPX behavioral2/memory/3524-153-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 2792 e574ce7.exe 2184 e574e3f.exe 3524 e57689d.exe -
resource yara_rule behavioral2/memory/2792-6-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-8-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-11-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-10-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-9-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-12-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-24-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-29-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-32-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-33-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-34-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-35-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-36-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-38-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-39-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-41-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-42-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-52-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-53-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-54-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-64-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-66-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-69-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-71-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-73-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-76-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-78-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-84-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-85-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2792-87-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3524-122-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/3524-152-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57689d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57689d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574ce7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57689d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57689d.exe - Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e574ce7.exe File opened (read-only) \??\I: e574ce7.exe File opened (read-only) \??\P: e574ce7.exe File opened (read-only) \??\N: e574ce7.exe File opened (read-only) \??\O: e574ce7.exe File opened (read-only) \??\E: e57689d.exe File opened (read-only) \??\G: e574ce7.exe File opened (read-only) \??\H: e574ce7.exe File opened (read-only) \??\M: e574ce7.exe File opened (read-only) \??\Q: e574ce7.exe File opened (read-only) \??\R: e574ce7.exe File opened (read-only) \??\S: e574ce7.exe File opened (read-only) \??\J: e574ce7.exe File opened (read-only) \??\K: e574ce7.exe File opened (read-only) \??\L: e574ce7.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e574ce7.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e574ce7.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e574ce7.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e574ce7.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e574d45 e574ce7.exe File opened for modification C:\Windows\SYSTEM.INI e574ce7.exe File created C:\Windows\e579de6 e57689d.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2792 e574ce7.exe 2792 e574ce7.exe 2792 e574ce7.exe 2792 e574ce7.exe 3524 e57689d.exe 3524 e57689d.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe Token: SeDebugPrivilege 2792 e574ce7.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2492 3008 rundll32.exe 81 PID 3008 wrote to memory of 2492 3008 rundll32.exe 81 PID 3008 wrote to memory of 2492 3008 rundll32.exe 81 PID 2492 wrote to memory of 2792 2492 rundll32.exe 82 PID 2492 wrote to memory of 2792 2492 rundll32.exe 82 PID 2492 wrote to memory of 2792 2492 rundll32.exe 82 PID 2792 wrote to memory of 788 2792 e574ce7.exe 8 PID 2792 wrote to memory of 796 2792 e574ce7.exe 9 PID 2792 wrote to memory of 376 2792 e574ce7.exe 13 PID 2792 wrote to memory of 2616 2792 e574ce7.exe 44 PID 2792 wrote to memory of 2632 2792 e574ce7.exe 45 PID 2792 wrote to memory of 2776 2792 e574ce7.exe 48 PID 2792 wrote to memory of 3516 2792 e574ce7.exe 56 PID 2792 wrote to memory of 3660 2792 e574ce7.exe 57 PID 2792 wrote to memory of 3840 2792 e574ce7.exe 58 PID 2792 wrote to memory of 3928 2792 e574ce7.exe 59 PID 2792 wrote to memory of 3988 2792 e574ce7.exe 60 PID 2792 wrote to memory of 668 2792 e574ce7.exe 61 PID 2792 wrote to memory of 3532 2792 e574ce7.exe 62 PID 2792 wrote to memory of 4740 2792 e574ce7.exe 64 PID 2792 wrote to memory of 1064 2792 e574ce7.exe 75 PID 2792 wrote to memory of 3008 2792 e574ce7.exe 80 PID 2792 wrote to memory of 2492 2792 e574ce7.exe 81 PID 2792 wrote to memory of 2492 2792 e574ce7.exe 81 PID 2492 wrote to memory of 2184 2492 rundll32.exe 83 PID 2492 wrote to memory of 2184 2492 rundll32.exe 83 PID 2492 wrote to memory of 2184 2492 rundll32.exe 83 PID 2492 wrote to memory of 3524 2492 rundll32.exe 84 PID 2492 wrote to memory of 3524 2492 rundll32.exe 84 PID 2492 wrote to memory of 3524 2492 rundll32.exe 84 PID 2792 wrote to memory of 788 2792 e574ce7.exe 8 PID 2792 wrote to memory of 796 2792 e574ce7.exe 9 PID 2792 wrote to memory of 376 2792 e574ce7.exe 13 PID 2792 wrote to memory of 2616 2792 e574ce7.exe 44 PID 2792 wrote to memory of 2632 2792 e574ce7.exe 45 PID 2792 wrote to memory of 2776 2792 e574ce7.exe 48 PID 2792 wrote to memory of 3516 2792 e574ce7.exe 56 PID 2792 wrote to memory of 3660 2792 e574ce7.exe 57 PID 2792 wrote to memory of 3840 2792 e574ce7.exe 58 PID 2792 wrote to memory of 3928 2792 e574ce7.exe 59 PID 2792 wrote to memory of 3988 2792 e574ce7.exe 60 PID 2792 wrote to memory of 668 2792 e574ce7.exe 61 PID 2792 wrote to memory of 3532 2792 e574ce7.exe 62 PID 2792 wrote to memory of 4740 2792 e574ce7.exe 64 PID 2792 wrote to memory of 1064 2792 e574ce7.exe 75 PID 2792 wrote to memory of 2184 2792 e574ce7.exe 83 PID 2792 wrote to memory of 2184 2792 e574ce7.exe 83 PID 2792 wrote to memory of 3524 2792 e574ce7.exe 84 PID 2792 wrote to memory of 3524 2792 e574ce7.exe 84 PID 3524 wrote to memory of 788 3524 e57689d.exe 8 PID 3524 wrote to memory of 796 3524 e57689d.exe 9 PID 3524 wrote to memory of 376 3524 e57689d.exe 13 PID 3524 wrote to memory of 2616 3524 e57689d.exe 44 PID 3524 wrote to memory of 2632 3524 e57689d.exe 45 PID 3524 wrote to memory of 2776 3524 e57689d.exe 48 PID 3524 wrote to memory of 3516 3524 e57689d.exe 56 PID 3524 wrote to memory of 3660 3524 e57689d.exe 57 PID 3524 wrote to memory of 3840 3524 e57689d.exe 58 PID 3524 wrote to memory of 3928 3524 e57689d.exe 59 PID 3524 wrote to memory of 3988 3524 e57689d.exe 60 PID 3524 wrote to memory of 668 3524 e57689d.exe 61 PID 3524 wrote to memory of 3532 3524 e57689d.exe 62 PID 3524 wrote to memory of 4740 3524 e57689d.exe 64 PID 3524 wrote to memory of 1064 3524 e57689d.exe 75 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57689d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2632
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2776
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdf8e2fca3c6b0e8bad30203b0cf148da5ec734e9914d5556e0745cc5f379dfe.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdf8e2fca3c6b0e8bad30203b0cf148da5ec734e9914d5556e0745cc5f379dfe.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\e574ce7.exeC:\Users\Admin\AppData\Local\Temp\e574ce7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\e574e3f.exeC:\Users\Admin\AppData\Local\Temp\e574e3f.exe4⤵
- Executes dropped EXE
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\e57689d.exeC:\Users\Admin\AppData\Local\Temp\e57689d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3524
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3840
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3988
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:668
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3532
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4740
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1064
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e574ce7.exe
- Size 97KB
- SHA256 018140d8eca3ee42b77f37ec8f89a5ca8338193354d4d9aaf2bd174138b22bf3
- MD5 c1ee556c48d7dc153ec7e721fad0f822
- SHA1 22280d97b38bf5f0772ce94b281c1b11f059bbd3
- SHA512 e995ebc37903ea801289a1c94612b643eb0b19e0718611fe33e5820b297da95c27f265290f4f90dadbba432ee5905db0a9328e7e62eebfec8edb0e89d02bdb09
- SSDEEP 1536:LRTUYq9Y9WG8WPllPQYS5x4esGum1Ije+9br49OAg9va0+RzZ:9wY95PlloHcLGu0I6XwA8i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 b7d6995a1ebffe7da816b864ce18485f428ebd25b1aa850b54e974ea7dfe15f5
- MD5 3f96c2d934d83f0b8c3c04ecd04c3178
- SHA1 d480d203bdad2c6d275f3abcc099df90ce1bfd86
- SHA512 431a2c3c0662f5408c7576cc65874a47fa7148851bde882f94c7eea4cc607c4d618ac329ab34306a5ad9970cc7f5b12ceffb8b851c316ef622025009d2551a28
- MD5 SHA1 SHA512