Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b87593e859e3b4485dcaf6501f7c9bb8b4ee2e0bb178687c2aab13e574da58ee.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
-
Target
b87593e859e3b4485dcaf6501f7c9bb8b4ee2e0bb178687c2aab13e574da58ee.dll
-
Size
120KB
-
MD5
c3c1e0336aa60561ac46a8ba7fed198f
-
SHA1
ae00cd7d696d1793fc83a10d0e47c1be618828db
-
SHA256
b87593e859e3b4485dcaf6501f7c9bb8b4ee2e0bb178687c2aab13e574da58ee
-
SHA512
3df257fb4976b2c7473684b7dc6074b9774933ed106b736340931a64f87e9202e61c53705442066f242aa1185d608ebe659c16a9f9bc32923983e6ebc01ff2b3
-
SSDEEP
1536:jrnrP/Sw4KR16cvkQGkn5fLCcSZd8wWIIGjFDegk8d6Rxcm9DboNNDyqELaluuO+:H+DKR71EcSZdzIunk8Wxd9nucelut
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761d02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761d02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76514b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76514b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76514b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76514b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76514b.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 27 IoCs
resource yara_rule behavioral1/memory/2404-12-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-15-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-17-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-20-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-21-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-22-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-19-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-18-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-16-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-14-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-23-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-62-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-63-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-64-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-65-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-66-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-81-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-83-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-97-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-103-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-106-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-109-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-111-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-113-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2404-141-0x00000000005A0000-0x000000000165A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-153-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-183-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral1/memory/2404-11-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2404-12-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-15-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-17-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-20-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-21-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-22-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-19-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-18-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-16-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-14-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-23-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-62-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-63-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-64-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-65-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-66-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-81-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-83-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-97-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-103-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-106-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-109-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-111-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-113-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2404-140-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2404-141-0x00000000005A0000-0x000000000165A000-memory.dmp UPX behavioral1/memory/2872-153-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/2872-183-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/2872-184-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2828-238-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 2404 f761d02.exe 2872 f761ec7.exe 2828 f76514b.exe -
Loads dropped DLL 6 IoCs
pid Process 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe -
resource yara_rule behavioral1/memory/2404-12-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-15-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-17-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-20-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-21-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-22-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-19-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-18-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-16-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-14-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-23-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-62-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-63-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-64-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-65-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-66-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-81-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-83-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-97-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-103-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-106-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-109-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-111-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-113-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2404-141-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-153-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2872-183-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761ec7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76514b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76514b.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: f761d02.exe File opened (read-only) \??\L: f761d02.exe File opened (read-only) \??\I: f76514b.exe File opened (read-only) \??\H: f761d02.exe File opened (read-only) \??\N: f761d02.exe File opened (read-only) \??\E: f76514b.exe File opened (read-only) \??\E: f761d02.exe File opened (read-only) \??\G: f76514b.exe File opened (read-only) \??\J: f761d02.exe File opened (read-only) \??\I: f761d02.exe File opened (read-only) \??\M: f761d02.exe File opened (read-only) \??\H: f76514b.exe File opened (read-only) \??\J: f76514b.exe File opened (read-only) \??\G: f761d02.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f761d60 f761d02.exe File opened for modification C:\Windows\SYSTEM.INI f761d02.exe File created C:\Windows\f766db1 f761ec7.exe File created C:\Windows\f767899 f76514b.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2404 f761d02.exe 2404 f761d02.exe 2872 f761ec7.exe 2828 f76514b.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2404 f761d02.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2872 f761ec7.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe Token: SeDebugPrivilege 2828 f76514b.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2248 2220 rundll32.exe 28 PID 2220 wrote to memory of 2248 2220 rundll32.exe 28 PID 2220 wrote to memory of 2248 2220 rundll32.exe 28 PID 2220 wrote to memory of 2248 2220 rundll32.exe 28 PID 2220 wrote to memory of 2248 2220 rundll32.exe 28 PID 2220 wrote to memory of 2248 2220 rundll32.exe 28 PID 2220 wrote to memory of 2248 2220 rundll32.exe 28 PID 2248 wrote to memory of 2404 2248 rundll32.exe 29 PID 2248 wrote to memory of 2404 2248 rundll32.exe 29 PID 2248 wrote to memory of 2404 2248 rundll32.exe 29 PID 2248 wrote to memory of 2404 2248 rundll32.exe 29 PID 2404 wrote to memory of 1112 2404 f761d02.exe 19 PID 2404 wrote to memory of 1172 2404 f761d02.exe 20 PID 2404 wrote to memory of 1204 2404 f761d02.exe 21 PID 2404 wrote to memory of 1708 2404 f761d02.exe 23 PID 2404 wrote to memory of 2220 2404 f761d02.exe 27 PID 2404 wrote to memory of 2248 2404 f761d02.exe 28 PID 2404 wrote to memory of 2248 2404 f761d02.exe 28 PID 2248 wrote to memory of 2872 2248 rundll32.exe 30 PID 2248 wrote to memory of 2872 2248 rundll32.exe 30 PID 2248 wrote to memory of 2872 2248 rundll32.exe 30 PID 2248 wrote to memory of 2872 2248 rundll32.exe 30 PID 2404 wrote to memory of 1112 2404 f761d02.exe 19 PID 2404 wrote to memory of 1172 2404 f761d02.exe 20 PID 2404 wrote to memory of 1204 2404 f761d02.exe 21 PID 2404 wrote to memory of 2220 2404 f761d02.exe 27 PID 2404 wrote to memory of 2872 2404 f761d02.exe 30 PID 2404 wrote to memory of 2872 2404 f761d02.exe 30 PID 2248 wrote to memory of 2828 2248 rundll32.exe 31 PID 2248 wrote to memory of 2828 2248 rundll32.exe 31 PID 2248 wrote to memory of 2828 2248 rundll32.exe 31 PID 2248 wrote to memory of 2828 2248 rundll32.exe 31 PID 2872 wrote to memory of 1112 2872 f761ec7.exe 19 PID 2872 wrote to memory of 1172 2872 f761ec7.exe 20 PID 2872 wrote to memory of 1204 2872 f761ec7.exe 21 PID 2872 wrote to memory of 2828 2872 f761ec7.exe 31 PID 2872 wrote to memory of 2828 2872 f761ec7.exe 31 PID 2828 wrote to memory of 1112 2828 f76514b.exe 19 PID 2828 wrote to memory of 1172 2828 f76514b.exe 20 PID 2828 wrote to memory of 1204 2828 f76514b.exe 21 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761ec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76514b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d02.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b87593e859e3b4485dcaf6501f7c9bb8b4ee2e0bb178687c2aab13e574da58ee.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b87593e859e3b4485dcaf6501f7c9bb8b4ee2e0bb178687c2aab13e574da58ee.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\f761d02.exeC:\Users\Admin\AppData\Local\Temp\f761d02.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\f761ec7.exeC:\Users\Admin\AppData\Local\Temp\f761ec7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\f76514b.exeC:\Users\Admin\AppData\Local\Temp\f76514b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2828
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1708
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD593c96d4ff11aa86f409ce04338614ec5
SHA150258c28cbfcb0410d217ba327830b6cbc65674c
SHA2561f9e8c9d87c2ddeed252c05d424f525b86aac272dd0713b7bfb1bc15b304d0ac
SHA512e85bc7677e7ee86faadfa9eac75dc9260fb0b42a17e8127e0c32f1c6100848725454fbe55ac868892e1aba53ada679b1d7dd4566ec69bdcdc1021d721b5125a2
-
Filesize
97KB
MD53a196cc7c82a247b50759758c8d8c977
SHA1a4e908d85f89a021deccd278f72d13a4bb8d8b05
SHA256f6893a4b04169cb00a633dc2f9730280958e0042a0a80818dbfa6708ab14ffa1
SHA51201542586a7d5588849bb07bdf705b3709fc87681b284ff3130859677cfcd5b9fff37b5b4394002f21bf257aab2d0432e0d93afea41bf7cd5cf6bffa77a0aed9b