Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 23:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93d4f6c518c701ab1571a7ed202561f03aec10465e00a32d8cd9c187239dc17f.dll
Resource
win7-20240611-en
windows7-x64
17 signatures
150 seconds
General
-
Target
93d4f6c518c701ab1571a7ed202561f03aec10465e00a32d8cd9c187239dc17f.dll
-
Size
120KB
-
MD5
1082adbed9ace9eddddcd5f65fcaff68
-
SHA1
84dcc13a7ea409013b8056a15147e8022d2deea4
-
SHA256
93d4f6c518c701ab1571a7ed202561f03aec10465e00a32d8cd9c187239dc17f
-
SHA512
4ce0fe7bdc180d8093e94013a95de3942c46d2399669f5cb090472c63a7c6dda1477d2b169b85f6e7d1620983629655aac86b7e8fc0f1d57a04f62146b66912a
-
SSDEEP
1536:boNp5lu+pIOiwvIx6uLyFf+Ff8KgkNRs6qFNijwG9jHIi7l9YzSDcpH:0pu+pYxx6pf+mkNR5jw08iwzi
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f760696.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f760696.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76084a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76084a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76084a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76084a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760696.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
resource yara_rule behavioral1/memory/2748-21-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-20-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-15-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-19-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-14-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-13-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-17-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-18-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-22-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-16-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-58-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-59-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-60-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-61-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-62-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-77-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-78-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-80-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-98-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-99-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-101-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-102-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-104-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-107-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-108-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2748-140-0x0000000000590000-0x000000000164A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-153-0x0000000000910000-0x00000000019CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2740-175-0x0000000000910000-0x00000000019CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral1/memory/2748-21-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-20-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-15-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-19-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-14-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-13-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-17-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-18-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-22-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-16-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2740-57-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2748-58-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-59-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-60-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-61-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-62-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-77-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-78-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-80-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-98-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-99-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-101-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-102-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-104-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-107-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-108-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2748-141-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2748-140-0x0000000000590000-0x000000000164A000-memory.dmp UPX behavioral1/memory/2740-153-0x0000000000910000-0x00000000019CA000-memory.dmp UPX behavioral1/memory/2740-174-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2740-175-0x0000000000910000-0x00000000019CA000-memory.dmp UPX behavioral1/memory/1572-179-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 2748 f760696.exe 2740 f76084a.exe 1572 f7623c6.exe -
Loads dropped DLL 6 IoCs
pid Process 1716 rundll32.exe 1716 rundll32.exe 1716 rundll32.exe 1716 rundll32.exe 1716 rundll32.exe 1716 rundll32.exe -
resource yara_rule behavioral1/memory/2748-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-13-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-58-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-59-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-60-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-77-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-78-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-80-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-98-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-99-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-101-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-102-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-104-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-107-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-108-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2748-140-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2740-153-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2740-175-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760696.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760696.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76084a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76084a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760696.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f760696.exe File opened (read-only) \??\I: f760696.exe File opened (read-only) \??\M: f760696.exe File opened (read-only) \??\E: f760696.exe File opened (read-only) \??\G: f760696.exe File opened (read-only) \??\J: f760696.exe File opened (read-only) \??\K: f760696.exe File opened (read-only) \??\L: f760696.exe File opened (read-only) \??\Q: f760696.exe File opened (read-only) \??\O: f760696.exe File opened (read-only) \??\P: f760696.exe File opened (read-only) \??\R: f760696.exe File opened (read-only) \??\N: f760696.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f760703 f760696.exe File opened for modification C:\Windows\SYSTEM.INI f760696.exe File created C:\Windows\f765754 f76084a.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2748 f760696.exe 2748 f760696.exe 2740 f76084a.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2748 f760696.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe Token: SeDebugPrivilege 2740 f76084a.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1716 2648 rundll32.exe 28 PID 2648 wrote to memory of 1716 2648 rundll32.exe 28 PID 2648 wrote to memory of 1716 2648 rundll32.exe 28 PID 2648 wrote to memory of 1716 2648 rundll32.exe 28 PID 2648 wrote to memory of 1716 2648 rundll32.exe 28 PID 2648 wrote to memory of 1716 2648 rundll32.exe 28 PID 2648 wrote to memory of 1716 2648 rundll32.exe 28 PID 1716 wrote to memory of 2748 1716 rundll32.exe 29 PID 1716 wrote to memory of 2748 1716 rundll32.exe 29 PID 1716 wrote to memory of 2748 1716 rundll32.exe 29 PID 1716 wrote to memory of 2748 1716 rundll32.exe 29 PID 2748 wrote to memory of 1248 2748 f760696.exe 19 PID 2748 wrote to memory of 1328 2748 f760696.exe 20 PID 2748 wrote to memory of 1356 2748 f760696.exe 21 PID 2748 wrote to memory of 1904 2748 f760696.exe 23 PID 2748 wrote to memory of 2648 2748 f760696.exe 27 PID 2748 wrote to memory of 1716 2748 f760696.exe 28 PID 2748 wrote to memory of 1716 2748 f760696.exe 28 PID 1716 wrote to memory of 2740 1716 rundll32.exe 30 PID 1716 wrote to memory of 2740 1716 rundll32.exe 30 PID 1716 wrote to memory of 2740 1716 rundll32.exe 30 PID 1716 wrote to memory of 2740 1716 rundll32.exe 30 PID 1716 wrote to memory of 1572 1716 rundll32.exe 31 PID 1716 wrote to memory of 1572 1716 rundll32.exe 31 PID 1716 wrote to memory of 1572 1716 rundll32.exe 31 PID 1716 wrote to memory of 1572 1716 rundll32.exe 31 PID 2748 wrote to memory of 1248 2748 f760696.exe 19 PID 2748 wrote to memory of 1328 2748 f760696.exe 20 PID 2748 wrote to memory of 1356 2748 f760696.exe 21 PID 2748 wrote to memory of 2740 2748 f760696.exe 30 PID 2748 wrote to memory of 2740 2748 f760696.exe 30 PID 2748 wrote to memory of 1572 2748 f760696.exe 31 PID 2748 wrote to memory of 1572 2748 f760696.exe 31 PID 2740 wrote to memory of 1248 2740 f76084a.exe 19 PID 2740 wrote to memory of 1328 2740 f76084a.exe 20 PID 2740 wrote to memory of 1356 2740 f76084a.exe 21 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76084a.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1248
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1328
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1356
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93d4f6c518c701ab1571a7ed202561f03aec10465e00a32d8cd9c187239dc17f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93d4f6c518c701ab1571a7ed202561f03aec10465e00a32d8cd9c187239dc17f.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\f760696.exeC:\Users\Admin\AppData\Local\Temp\f760696.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\f76084a.exeC:\Users\Admin\AppData\Local\Temp\f76084a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\f7623c6.exeC:\Users\Admin\AppData\Local\Temp\f7623c6.exe4⤵
- Executes dropped EXE
PID:1572
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1904
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5d6af33e48e394222ec665351cc85b653
SHA1049e1de31a1c7ecdaaea5aca92131f8b691f8eb6
SHA256c128192b2416d9cae097341e344429fe9471ef5d80a31dbdce01448b9a3398fa
SHA512c48635e98825b1566ea418244757f7f073746f76c9be0370730c202f234140ed8ae64ec38e5a67bc618c7073e7e90fd80285f4523071059941d48410f803882b
-
Filesize
97KB
MD53c221211a02db3e5906b043d4e8584bb
SHA1b699072d044e0fad1dfc534f4a3d422552c89ede
SHA256b1f8348d6fa6d6b5299d83468df99ff7e311a86eb103d61cb8f768c387abf92f
SHA51250c1fa7754aa8dafbe99b3093a15cd068fe191204ce96d7ac0fc776e60fa391f8b8865954c98d1b23b8488bb78c0fb52f6dbd946be5cc91f3c742180784434b4