Overview
overview
10Static
static
3e1b2e96bb5...c6.exe
windows7-x64
10e1b2e96bb5...c6.exe
windows10-2004-x64
10$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
- max time kernel
9s - max time network
16s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
11/06/2024, 04:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe
Resource
win7-20240508-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe
- Size 332KB
- Sample240611-evdknavbpp
- SHA256 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6
- MD5 2569981f3c1ed36a7b1ed6f215e739a2
- SHA1 de12426615e9d6d26ac67babcaca82351fdd7a54
- SHA512 93b26b7a164ca9b0e22ac192eda7266b9904f5ba762b96f6128185b496808a728b5ce11584a5dca2e87df56b3401afdab4f2264ffd0db704a32f0c2b84930dc0
- SSDEEP 6144:mN/IaoYuk96kADp70jutbFs6XDVsK+/OVtK4cj9K1+2BoUz6jJQPI:aLWYjutacDVsAVMJKcmoUzaaPI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs
resource yara_rule behavioral1/memory/1716-2-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-5-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-10-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-11-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-8-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-4-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-54-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-69-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-60-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-58-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-67-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-64-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-65-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-63-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-62-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-61-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-59-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-92-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-91-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-12-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-9-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-7-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1716-6-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-106-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-164-0x0000000001F90000-0x000000000304A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x0000000000480000-memory.dmp UPX behavioral1/memory/1716-2-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-5-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-10-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-11-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-8-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-4-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-54-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-69-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-60-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-58-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-68-0x0000000000400000-0x0000000000480000-memory.dmp UPX behavioral1/memory/2740-67-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-64-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-65-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-63-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-62-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-61-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-59-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-53-0x0000000000400000-0x0000000000480000-memory.dmp UPX behavioral1/memory/2740-92-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-91-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-12-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-9-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-7-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/1716-6-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-106-0x0000000001F90000-0x000000000304A000-memory.dmp UPX behavioral1/memory/2740-164-0x0000000001F90000-0x000000000304A000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2740 Au_.exe - Loads dropped DLL 3 IoCs
pid Process 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 2740 Au_.exe 2740 Au_.exe -
resource yara_rule behavioral1/memory/1716-2-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-5-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-10-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-11-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-8-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-4-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-54-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-69-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-60-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-58-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-67-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-64-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-65-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-63-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-62-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-61-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-59-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-92-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-91-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-12-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-9-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-7-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/1716-6-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-106-0x0000000001F90000-0x000000000304A000-memory.dmp upx behavioral1/memory/2740-164-0x0000000001F90000-0x000000000304A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe - Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Au_.exe File opened (read-only) \??\G: Au_.exe File opened (read-only) \??\H: Au_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe File created C:\Windows\f762694 Au_.exe File created C:\Windows\f762491 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0007000000016d4c-35.dat nsis_installer_2 behavioral1/files/0x0038000000016d1a-95.dat nsis_installer_2 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 2740 Au_.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe Token: SeDebugPrivilege 2740 Au_.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1068 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 18 PID 1716 wrote to memory of 1076 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 19 PID 1716 wrote to memory of 1144 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 20 PID 1716 wrote to memory of 2384 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 23 PID 1716 wrote to memory of 2740 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 28 PID 1716 wrote to memory of 2740 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 28 PID 1716 wrote to memory of 2740 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 28 PID 1716 wrote to memory of 2740 1716 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 28 PID 2740 wrote to memory of 1068 2740 Au_.exe 18 PID 2740 wrote to memory of 1076 2740 Au_.exe 19 PID 2740 wrote to memory of 1144 2740 Au_.exe 20 PID 2740 wrote to memory of 2384 2740 Au_.exe 23 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1068
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1076
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe"C:\Users\Admin\AppData\Local\Temp\e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2740
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2384
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0F762CFA_Rar\Au_.exe
- Size 256KB
- SHA256 1825160a506ec596c02ab9869493671bd5c00118e602afc4a3c254a378c024c5
- MD5 a6a6ec93d611f8247a8198acbdead370
- SHA1 bbb7c81157fff69d94f6122ea96f58bf01067bc0
- SHA512 b5fb1f27733e0817190c503e94fbbed5c20f986460141f9ca079326250df7adcfd1946e330fa28c703e88a81861312423af136914466d622920ce1092ccfe802
- SSDEEP 6144:yN/IaoYuk96kADpyOVtK4cj9K1+2BoUz6jJQPI:eLW7VMJKcmoUzaaPI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 256B
- SHA256 df67707ca97de7da9067c5e6e089b8f927053aff534d60453791894ee568e824
- MD5 3f0cfb29d67bcda571fceea5dda4c66d
- SHA1 04be8cb89cf0713752b57ac1dabc81029de722af
- SHA512 14ed52d62b018247a620fd78d05c7e432f865ac17146ede85a32208d8b06d547a62b0408018fe8576d021308d119205891c2eb8e1c151debf987607512746edd
- MD5 SHA1 SHA512
- Path C:\cqyul.pif
- Size 97KB
- SHA256 6973736dad19ae639f43c3e9a1e597ff341598e09d6d11e6c205313c2bd07635
- MD5 349538f30991173ed19c2df0a66b2bee
- SHA1 f088820e92eabdebdf7561e3c99243062094ca03
- SHA512 3daa3a3193e148cb4945b0f2d0aadcff749973ad2df8fbd97bf3c6659ec7726d807e1b25c74ce545d128d664dd300c4eb6cb2cb965b1e1ea749304809222956b
- SSDEEP 1536:Ng4Q8Su6YTSy1pn61Vne5aewxdCrNPnrX8A6jDXnaD0idKlA9:NPf7SjTe8rCrN/rX8A6XXnaCA
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso2DE6.tmp\LangDLL.dll
- Size 7KB
- SHA256 32487e83679c88f63f35a9989e58ef3a3084bd70b6ebe76cda459c92ebf2c066
- MD5 ccb909b48488ac50078b994947cf855c
- SHA1 08ef6ff2b4df6de0bdc443611815a8db619b6c70
- SHA512 ebe5dece02bd459d8d28457fe082bc759c21c0bb641ed31a848e2b521bfd9d2544585b0acbb1dfd08a5a9b91a91bba5aa5339c0f736fd153f852af17144caac8
- SSDEEP 96:X80Gzrjk9CYIh6SnCQ5ygkSoZrtjlPVng1/GsoJoiB:DGbeINnC4oZrjPdIOjqi
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso2DE6.tmp\UAC.dll
- Size 36KB
- SHA256 07ad34100502d7aebd8c19cf6fabda31814312984ae25d26b081ddebf3926077
- MD5 e6ab90ea8f9454d4a8aed70eb924bb4a
- SHA1 22d7c541e93e3d5520756047e3af0324af7640e5
- SHA512 23953f4163afe3a2ebadbba03e7bec5bab10c8c112ab093e3893ec11d6d4232a526014f02db995b60f63b7cc8e49f2883a6e2112092176ccfa28a45f2397527a
- SSDEEP 768:4mlFrRNxK9CxHpR2fYw4G3ridSzSH7YHJ2I5:4kFrFJpR2AhGcYB5
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
- Size 332KB
- SHA256 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6
- MD5 2569981f3c1ed36a7b1ed6f215e739a2
- SHA1 de12426615e9d6d26ac67babcaca82351fdd7a54
- SHA512 93b26b7a164ca9b0e22ac192eda7266b9904f5ba762b96f6128185b496808a728b5ce11584a5dca2e87df56b3401afdab4f2264ffd0db704a32f0c2b84930dc0
- SSDEEP 6144:mN/IaoYuk96kADp70jutbFs6XDVsK+/OVtK4cj9K1+2BoUz6jJQPI:aLWYjutacDVsAVMJKcmoUzaaPI
- MD5 SHA1 SHA512 SSDEEP