Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b51679df5b3ce71903c861b481a398c7798719435750bcacd1be8803deb3e44.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target 6b51679df5b3ce71903c861b481a398c7798719435750bcacd1be8803deb3e44.dll
- Size 120KB
- Sample240614-2b8ysaydkb
- SHA256 6b51679df5b3ce71903c861b481a398c7798719435750bcacd1be8803deb3e44
- MD5 200fe820486ce8a7796c07359a4c0177
- SHA1 6e06bf6fd554389a45b2533b80073bdc17f26bc6
- SHA512 f0842f27704206f3e2991ecd93dd9ddd73119e8ded22ca4ce077ab074c576d5e948c767cc5adb566f0ece4c7d2bb6c53107b0a020797aebb4b4b58bf197343ed
- SSDEEP 1536:GjBY5eg+M7Wl7PZeS1LrJshGLbHOHd/VPxyDDWXselcdNueiop7tRNhFgS:F5eg+M+zIeLV5bwd/nyDzseTnFgS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574120.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574120.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575cd5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575cd5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575cd5.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 34 IoCs
resource yara_rule behavioral2/memory/3520-10-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-9-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-11-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-19-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-35-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-30-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-15-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-8-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-12-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-6-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-36-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-37-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-38-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-39-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-40-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-41-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-43-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-44-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-52-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-54-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-55-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-66-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-67-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-71-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-73-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-74-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-76-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-77-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-78-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-79-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-80-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3520-82-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4268-116-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4268-149-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 38 IoCs
resource yara_rule behavioral2/memory/3520-10-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-9-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-11-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-19-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/2404-34-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3520-35-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-30-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-15-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-8-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-12-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-6-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-36-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-37-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-38-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-39-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-40-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-41-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-43-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-44-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-52-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-54-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-55-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-66-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-67-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-71-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-73-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-74-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-76-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-77-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-78-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-79-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-80-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-82-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3520-101-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2404-105-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4268-116-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/4268-150-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4268-149-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 3520 e574120.exe 2404 e574239.exe 4268 e575cd5.exe -
resource yara_rule behavioral2/memory/3520-10-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-9-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-11-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-19-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-35-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-30-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-15-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-8-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-12-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-6-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-36-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-37-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-38-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-39-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-40-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-41-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-43-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-44-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-52-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-54-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-55-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-66-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-67-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-71-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-73-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-74-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-76-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-77-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-78-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-79-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-80-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3520-82-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4268-116-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/4268-149-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575cd5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574120.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575cd5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575cd5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575cd5.exe - Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e574120.exe File opened (read-only) \??\M: e574120.exe File opened (read-only) \??\Q: e574120.exe File opened (read-only) \??\H: e574120.exe File opened (read-only) \??\R: e574120.exe File opened (read-only) \??\G: e574120.exe File opened (read-only) \??\N: e574120.exe File opened (read-only) \??\O: e574120.exe File opened (read-only) \??\P: e574120.exe File opened (read-only) \??\S: e574120.exe File opened (read-only) \??\E: e575cd5.exe File opened (read-only) \??\G: e575cd5.exe File opened (read-only) \??\I: e574120.exe File opened (read-only) \??\J: e574120.exe File opened (read-only) \??\K: e574120.exe File opened (read-only) \??\L: e574120.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e574120.exe File opened for modification C:\Program Files\7-Zip\7z.exe e574120.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e574120.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e574120.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57414f e574120.exe File opened for modification C:\Windows\SYSTEM.INI e574120.exe File created C:\Windows\e5791c0 e575cd5.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3520 e574120.exe 3520 e574120.exe 3520 e574120.exe 3520 e574120.exe 4268 e575cd5.exe 4268 e575cd5.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe Token: SeDebugPrivilege 3520 e574120.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4184 wrote to memory of 2940 4184 rundll32.exe 81 PID 4184 wrote to memory of 2940 4184 rundll32.exe 81 PID 4184 wrote to memory of 2940 4184 rundll32.exe 81 PID 2940 wrote to memory of 3520 2940 rundll32.exe 82 PID 2940 wrote to memory of 3520 2940 rundll32.exe 82 PID 2940 wrote to memory of 3520 2940 rundll32.exe 82 PID 3520 wrote to memory of 776 3520 e574120.exe 8 PID 3520 wrote to memory of 784 3520 e574120.exe 9 PID 3520 wrote to memory of 1020 3520 e574120.exe 13 PID 3520 wrote to memory of 2960 3520 e574120.exe 50 PID 3520 wrote to memory of 3068 3520 e574120.exe 51 PID 3520 wrote to memory of 772 3520 e574120.exe 52 PID 3520 wrote to memory of 3428 3520 e574120.exe 56 PID 3520 wrote to memory of 3588 3520 e574120.exe 57 PID 3520 wrote to memory of 3780 3520 e574120.exe 58 PID 3520 wrote to memory of 3868 3520 e574120.exe 59 PID 3520 wrote to memory of 3936 3520 e574120.exe 60 PID 3520 wrote to memory of 4016 3520 e574120.exe 61 PID 3520 wrote to memory of 3568 3520 e574120.exe 62 PID 3520 wrote to memory of 2820 3520 e574120.exe 73 PID 3520 wrote to memory of 3240 3520 e574120.exe 74 PID 3520 wrote to memory of 3300 3520 e574120.exe 79 PID 3520 wrote to memory of 4184 3520 e574120.exe 80 PID 3520 wrote to memory of 2940 3520 e574120.exe 81 PID 3520 wrote to memory of 2940 3520 e574120.exe 81 PID 2940 wrote to memory of 2404 2940 rundll32.exe 83 PID 2940 wrote to memory of 2404 2940 rundll32.exe 83 PID 2940 wrote to memory of 2404 2940 rundll32.exe 83 PID 2940 wrote to memory of 4268 2940 rundll32.exe 87 PID 2940 wrote to memory of 4268 2940 rundll32.exe 87 PID 2940 wrote to memory of 4268 2940 rundll32.exe 87 PID 3520 wrote to memory of 776 3520 e574120.exe 8 PID 3520 wrote to memory of 784 3520 e574120.exe 9 PID 3520 wrote to memory of 1020 3520 e574120.exe 13 PID 3520 wrote to memory of 2960 3520 e574120.exe 50 PID 3520 wrote to memory of 3068 3520 e574120.exe 51 PID 3520 wrote to memory of 772 3520 e574120.exe 52 PID 3520 wrote to memory of 3428 3520 e574120.exe 56 PID 3520 wrote to memory of 3588 3520 e574120.exe 57 PID 3520 wrote to memory of 3780 3520 e574120.exe 58 PID 3520 wrote to memory of 3868 3520 e574120.exe 59 PID 3520 wrote to memory of 3936 3520 e574120.exe 60 PID 3520 wrote to memory of 4016 3520 e574120.exe 61 PID 3520 wrote to memory of 3568 3520 e574120.exe 62 PID 3520 wrote to memory of 2820 3520 e574120.exe 73 PID 3520 wrote to memory of 3240 3520 e574120.exe 74 PID 3520 wrote to memory of 2404 3520 e574120.exe 83 PID 3520 wrote to memory of 2404 3520 e574120.exe 83 PID 3520 wrote to memory of 756 3520 e574120.exe 85 PID 3520 wrote to memory of 3788 3520 e574120.exe 86 PID 3520 wrote to memory of 4268 3520 e574120.exe 87 PID 3520 wrote to memory of 4268 3520 e574120.exe 87 PID 4268 wrote to memory of 776 4268 e575cd5.exe 8 PID 4268 wrote to memory of 784 4268 e575cd5.exe 9 PID 4268 wrote to memory of 1020 4268 e575cd5.exe 13 PID 4268 wrote to memory of 2960 4268 e575cd5.exe 50 PID 4268 wrote to memory of 3068 4268 e575cd5.exe 51 PID 4268 wrote to memory of 772 4268 e575cd5.exe 52 PID 4268 wrote to memory of 3428 4268 e575cd5.exe 56 PID 4268 wrote to memory of 3588 4268 e575cd5.exe 57 PID 4268 wrote to memory of 3780 4268 e575cd5.exe 58 PID 4268 wrote to memory of 3868 4268 e575cd5.exe 59 PID 4268 wrote to memory of 3936 4268 e575cd5.exe 60 PID 4268 wrote to memory of 4016 4268 e575cd5.exe 61 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575cd5.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3068
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:772
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b51679df5b3ce71903c861b481a398c7798719435750bcacd1be8803deb3e44.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b51679df5b3ce71903c861b481a398c7798719435750bcacd1be8803deb3e44.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\e574120.exeC:\Users\Admin\AppData\Local\Temp\e574120.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3520
-
-
C:\Users\Admin\AppData\Local\Temp\e574239.exeC:\Users\Admin\AppData\Local\Temp\e574239.exe4⤵
- Executes dropped EXE
PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\e575cd5.exeC:\Users\Admin\AppData\Local\Temp\e575cd5.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4268
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3780
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3568
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2820
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3240
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3300
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:756
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3788
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e574120.exe
- Size 97KB
- SHA256 56c697090c8eccead9fa27ca34f1607f31557e9f15237c4612719b51c49c550b
- MD5 02d8c267a36e7af9694a51fec7f9f3b3
- SHA1 6235c22e3f0c9fee512e96cbda77663a00d27f2b
- SHA512 e5516d839033c4124f3bda63f3f9aa4fba471838b2df33b8f95c3688829359e1dcacb5b04641d562389b8d9e1dd91e015305ccf145f9c8b008d169ae1419da60
- SSDEEP 3072:ULJhU3cgtxSHoLbSqfIZZiQIEE4yYzB77X:ULJip3VdvEE2B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 e605a091ce36439364fc01885c92ea4cb6d9cf0ad9277b85d246c2a6271ea8e8
- MD5 56eb4a461598a54cf3c58953b29046b1
- SHA1 3a1a6e3c36b442dc44cb51b58cb70c964a66a78a
- SHA512 0c231a104324397c94c1559fd4d83be4d563973b5d6e67893428dfcb443bf1bba42f6b3f384c578bb50cf072ca7f62275efa4ca2d1d0690e32b3f33646df4d83
- MD5 SHA1 SHA512