Analysis
- max time kernel
122s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 12:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aspweb88.exe
Resource
win7-20240220-en
windows7-x64
19 signatures
150 seconds
General
- Target aspweb88.exe
- Size 711KB
- Sample240612-p7gsyswald
- SHA256 bc5cc5828933c52cfae2c801627e7d212104193e65c0cb1724dd7a44f11703f4
- MD5 c6c8cb870fe02f6e5bbb297ba36275cc
- SHA1 db370068fc0b89b57d3f2bfc250ba8ca2b040e31
- SHA512 f5539ccf41813414c26b09efb9bf8329d92c18374b4a002387c6f9c1118196e02441ed2fde5b8a04f7e8a0d45777f9fc3a0792aa2ba650916e189b9a0ad2570b
- SSDEEP 12288:2JFZqYMOaQ0q9nV/zsnK23KHVI6nodVdyMLiqyVcxwtVxgpMiuzOT5r7CjhSZhI:2FZqhOBnVyK23C6OoYMLiVcKtVx4Miu7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" aspweb88.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aspweb88.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aspweb88.exe -
resource yara_rule behavioral2/memory/984-1-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-4-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-3-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-6-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-7-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-10-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-13-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-14-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-5-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-15-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-16-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-20-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-22-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-21-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-39-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-49-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-50-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-53-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-64-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-66-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-68-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-75-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-76-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-77-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-78-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-79-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-80-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-97-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-98-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-106-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-107-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-108-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-111-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-112-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-115-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-117-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-118-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-119-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-121-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-122-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-124-0x0000000002370000-0x00000000033FE000-memory.dmp upx behavioral2/memory/984-125-0x0000000002370000-0x00000000033FE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" aspweb88.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aspweb88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aspweb88.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aspweb88.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: aspweb88.exe File opened (read-only) \??\k: aspweb88.exe File opened (read-only) \??\n: aspweb88.exe File opened (read-only) \??\p: aspweb88.exe File opened (read-only) \??\x: aspweb88.exe File opened (read-only) \??\H: aspweb88.exe File opened (read-only) \??\U: aspweb88.exe File opened (read-only) \??\e: aspweb88.exe File opened (read-only) \??\h: aspweb88.exe File opened (read-only) \??\L: aspweb88.exe File opened (read-only) \??\Q: aspweb88.exe File opened (read-only) \??\R: aspweb88.exe File opened (read-only) \??\Y: aspweb88.exe File opened (read-only) \??\g: aspweb88.exe File opened (read-only) \??\q: aspweb88.exe File opened (read-only) \??\u: aspweb88.exe File opened (read-only) \??\z: aspweb88.exe File opened (read-only) \??\O: aspweb88.exe File opened (read-only) \??\b: aspweb88.exe File opened (read-only) \??\o: aspweb88.exe File opened (read-only) \??\E: aspweb88.exe File opened (read-only) \??\J: aspweb88.exe File opened (read-only) \??\P: aspweb88.exe File opened (read-only) \??\X: aspweb88.exe File opened (read-only) \??\m: aspweb88.exe File opened (read-only) \??\r: aspweb88.exe File opened (read-only) \??\w: aspweb88.exe File opened (read-only) \??\G: aspweb88.exe File opened (read-only) \??\T: aspweb88.exe File opened (read-only) \??\v: aspweb88.exe File opened (read-only) \??\t: aspweb88.exe File opened (read-only) \??\y: aspweb88.exe File opened (read-only) \??\I: aspweb88.exe File opened (read-only) \??\M: aspweb88.exe File opened (read-only) \??\S: aspweb88.exe File opened (read-only) \??\W: aspweb88.exe File opened (read-only) \??\j: aspweb88.exe File opened (read-only) \??\l: aspweb88.exe File opened (read-only) \??\s: aspweb88.exe File opened (read-only) \??\K: aspweb88.exe File opened (read-only) \??\N: aspweb88.exe File opened (read-only) \??\V: aspweb88.exe File opened (read-only) \??\Z: aspweb88.exe File opened (read-only) \??\a: aspweb88.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 aspweb88.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf aspweb88.exe File opened for modification F:\autorun.inf aspweb88.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe aspweb88.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe aspweb88.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe aspweb88.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI aspweb88.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 4420 msedge.exe 4420 msedge.exe 2180 msedge.exe 2180 msedge.exe 984 aspweb88.exe 984 aspweb88.exe 564 identity_helper.exe 564 identity_helper.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe Token: SeDebugPrivilege 984 aspweb88.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 984 aspweb88.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe - Suspicious use of SendNotifyMessage 25 IoCs
pid Process 984 aspweb88.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe 984 aspweb88.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 984 wrote to memory of 788 984 aspweb88.exe 8 PID 984 wrote to memory of 796 984 aspweb88.exe 9 PID 984 wrote to memory of 384 984 aspweb88.exe 13 PID 984 wrote to memory of 2484 984 aspweb88.exe 42 PID 984 wrote to memory of 2496 984 aspweb88.exe 43 PID 984 wrote to memory of 2628 984 aspweb88.exe 46 PID 984 wrote to memory of 3412 984 aspweb88.exe 56 PID 984 wrote to memory of 3552 984 aspweb88.exe 57 PID 984 wrote to memory of 3752 984 aspweb88.exe 58 PID 984 wrote to memory of 3888 984 aspweb88.exe 59 PID 984 wrote to memory of 3956 984 aspweb88.exe 60 PID 984 wrote to memory of 4044 984 aspweb88.exe 61 PID 984 wrote to memory of 2404 984 aspweb88.exe 62 PID 984 wrote to memory of 4712 984 aspweb88.exe 64 PID 984 wrote to memory of 4856 984 aspweb88.exe 75 PID 984 wrote to memory of 1544 984 aspweb88.exe 80 PID 984 wrote to memory of 2180 984 aspweb88.exe 85 PID 984 wrote to memory of 2180 984 aspweb88.exe 85 PID 2180 wrote to memory of 2348 2180 msedge.exe 86 PID 2180 wrote to memory of 2348 2180 msedge.exe 86 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 3320 2180 msedge.exe 87 PID 2180 wrote to memory of 4420 2180 msedge.exe 88 PID 2180 wrote to memory of 4420 2180 msedge.exe 88 PID 2180 wrote to memory of 4472 2180 msedge.exe 89 PID 2180 wrote to memory of 4472 2180 msedge.exe 89 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aspweb88.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2496
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2628
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\aspweb88.exe"C:\Users\Admin\AppData\Local\Temp\aspweb88.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:88/3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe83d946f8,0x7ffe83d94708,0x7ffe83d947184⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:24⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:84⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:14⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:14⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:84⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:14⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:14⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:14⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:14⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2888 /prefetch:24⤵PID:2648
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3888
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3956
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2404
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4712
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4856
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1544
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:692
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4928
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4000
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:3428
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6361e43049888e9c83dc757471c58a065ca42bbef3366593eebb2e4437187f0b
- MD5 33822bdbe542277b1cc0e63e48cc8a5a
- SHA1 9959dad1b71c4602a7c5ae62c394a07063b0f2a5
- SHA512 1ba78d589e48f8d6278087c853000f9261eb5a966c4916732ada029434105e2119fbcd1bac70406efaec653fbd1cbfda00fd1bde2611c8c69b22c45bdc15b11e
- SSDEEP 96:n1kX414VhojVwpvWMoiVmdeSuQ1jmQo4aUWQyV+VD7AiEwb:n1kIWhojVGWMCuQhXarg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 882a0183341ed1617ccd0d4b3fd3821fdeb9bdb2517c2b56e514d4f981749972
- MD5 2db84ab7e172906f116e9af1dec03ab5
- SHA1 d98ec91b4e4c2074051fb65e6f589cae8b49c079
- SHA512 7a0c93f80e2cad1536f0d77a844ae6a98b9ab7ae2beb715ff5cd79f07ffefab5bf466b20c0352f3f15ea5e7eb6d4d185415ee733d7ae4bd80ee6a135ca2a44ec
- SSDEEP 96:n1kX414Vhoj0wpvWMoiVmdeSuQ1jmQo4aUWQyV+VD7AiEwb:n1kIWhoj0GWMCuQhXarg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 afd5c2cedcc6c33d6fd07bc1d58925ea1a45a9a67dbd3e33ae7cf693a0d51274
- MD5 dd0fc5bf7b7a9dc085b5486a227c2ffc
- SHA1 5132b8b7e43ac8e36a33f7ec1b8ea5a4f608dd96
- SHA512 96565bc68a136bc0572ea293f1896f972dbd356121b7855e993f46845d79b1df74eedd7adac999f3ee4c95f01d9216970152aee5389ee0eb86ccff071099b597
- SSDEEP 96:n1kD414Vhoj0wpvWMoiVmdeHmQI4aUWQyV+VDCziEwb:n1kkWhoj0GWMXfaro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 dab62225ac820a5ff43101896552686951a882d71c0a33a4da905a2b05e05916
- MD5 a97fbd905f4395d658c311af91e764cf
- SHA1 b67da1f4647105fd9df0d86ca2bbd4c952a461c9
- SHA512 b7de6e3e3a167ad48f87f4d3409b5113d51f2d0e9dff7e99c1a8fb4f99535f23a9a51f52121a857d75d74eda0aac80f6d6d6b37818a8e5f72f94e1f17f00b73e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEke2RUpIKby:A9iIxuERzA83h09RZxYEKqy
- MD5 SHA1 SHA512 SSDEEP
- Path F:\xcte.exe
- Size 96KB
- SHA256 f9e18769130797d5a5e18ba3147126f9161b487abcd32c1c4829620b574f21ce
- MD5 11d2b2817aa7e0bba812ae4447eca0de
- SHA1 24961bc10c90c37db488e9513f8324f43063d954
- SHA512 bf5e7ab47ac3b9b04b337deb7a8302b89583ef99ea6546b6d8b1728a6ce797cdaac173350f392f1985da2d3a5d67ae20e3a4053ce9ac6d38a20c968bc99ac59c
- SSDEEP 3072:VjhjjxK1kW/+qYI50bTFO8bpavw2PVcmYa2vY3O4GhS1:7XU1N4I5uhO8172d8Y3O4Gc
- MD5 SHA1 SHA512 SSDEEP