sality | bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Size 2.2MB
Sample240614-158pfasapl
SHA256 bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f
MD5 88e9d2c8fb64de8664191171145ef1cc
SHA1 47f9b7ba4c2bce92deb6405b911affbdc740ed91
SHA512 02a3e9ee62cc627bea00a5435e672da1b792f4d2b573d4cfedb55003aae2bda164408c1f78d164e8f4abc4aecfd83428cc93679dafb69a4a312a66652b43176d
SSDEEP 49152:PofH48nDdmXA2eelCmVQjvvmwXmqm7NrfOPCx309QTQ8N:PofH48DdCAReQIQTmw47Nrfb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3520-3-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/3520-4-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/3520-12-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/3520-8-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/3520-1-0x0000000002480000-0x000000000353A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\e573066	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
File opened for modification	C:\Windows\SYSTEM.INI	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
Token: SeDebugPrivilege	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 788	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	8
PID 3520 wrote to memory of 796	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	9
PID 3520 wrote to memory of 336	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	13
PID 3520 wrote to memory of 2628	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	45
PID 3520 wrote to memory of 2672	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	46
PID 3520 wrote to memory of 2824	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	49
PID 3520 wrote to memory of 3456	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	56
PID 3520 wrote to memory of 3636	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	57
PID 3520 wrote to memory of 3824	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	58
PID 3520 wrote to memory of 3928	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	59
PID 3520 wrote to memory of 3988	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	60
PID 3520 wrote to memory of 4072	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	61
PID 3520 wrote to memory of 3672	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	62
PID 3520 wrote to memory of 4248	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	63
PID 3520 wrote to memory of 4560	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	74
PID 3520 wrote to memory of 2404	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	75
PID 3520 wrote to memory of 4028	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	79
PID 3520 wrote to memory of 5096	3520	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe	80

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2672

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2824

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456
- C:\Windows\System32\xgmksa.exe
  "C:\Windows\System32\xgmksa.exe"
  2⤵
  PID:4248
- C:\Users\Admin\AppData\Local\Temp\bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe
  "C:\Users\Admin\AppData\Local\Temp\bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3636

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3824

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3988

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4072

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3672

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4560

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2404

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4028

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5096