sality | a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f

Analysis

max time kernel
22s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Size 740KB
Sample240620-b23xca1gnc
SHA256 a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f
MD5 e530024da0fb81b9834730e53d7734b1
SHA1 fd339c16a5e490e1b16d102a23f862200f7c7067
SHA512 433cd6d80b556b6cf96e94e73dacd3ac2036cea4b67feffa05ccce0f5595c6dfe83b57541ea4e39d641d85101de5f66dcd36c5ff1428e8b1f0163b92256f4cae
SSDEEP 12288:VTyjXW+48qWywrU4kGFezOAVuJ5PILww7F5DO3HYffsxmZ+B:ZIXW/8yw1ez54lInF5SXYHqma
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rundll32.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs

resource	yara_rule
behavioral2/memory/1456-1-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-4-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-6-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-10-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-15-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-5-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-16-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-18-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-7-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-20-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-21-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-30-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1456-24-0x0000000002E90000-0x0000000003F1E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-57-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-66-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-73-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-74-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-85-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-102-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/files/0x00070000000233b8-122.dat	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1432-143-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 41 IoCs

resource	yara_rule
behavioral2/memory/1456-1-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-4-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-6-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-10-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-15-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-5-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-16-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-18-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-7-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-20-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-21-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-30-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1456-42-0x0000000000400000-0x00000000004C1000-memory.dmp	UPX
behavioral2/memory/1456-24-0x0000000002E90000-0x0000000003F1E000-memory.dmp	UPX
behavioral2/memory/1432-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-57-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-66-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-73-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-74-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-85-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-102-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX
behavioral2/memory/1432-142-0x0000000000400000-0x00000000004C1000-memory.dmp	UPX
behavioral2/memory/1432-143-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	UPX

Deletes itself 1 IoCs

pid	Process
1432	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
1432	rundll32.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1456-1-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-4-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-6-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-10-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-15-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-5-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-16-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-18-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-7-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-20-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-21-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-30-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1456-24-0x0000000002E90000-0x0000000003F1E000-memory.dmp	upx
behavioral2/memory/1432-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-57-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-66-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-73-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-74-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-85-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-102-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx
behavioral2/memory/1432-143-0x0000000004EE0000-0x0000000005F6E000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
1432	rundll32.exe
1432	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
Token: SeDebugPrivilege	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
1432	rundll32.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 776	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	9
PID 1456 wrote to memory of 784	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	10
PID 1456 wrote to memory of 1016	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	13
PID 1456 wrote to memory of 2888	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	49
PID 1456 wrote to memory of 3004	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	51
PID 1456 wrote to memory of 428	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	53
PID 1456 wrote to memory of 3412	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	55
PID 1456 wrote to memory of 3580	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	57
PID 1456 wrote to memory of 3764	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	58
PID 1456 wrote to memory of 3860	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	59
PID 1456 wrote to memory of 3924	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	60
PID 1456 wrote to memory of 4000	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	61
PID 1456 wrote to memory of 3568	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	62
PID 1456 wrote to memory of 3076	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	73
PID 1456 wrote to memory of 4932	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	74
PID 1456 wrote to memory of 1432	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	80
PID 1456 wrote to memory of 1432	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	80
PID 1456 wrote to memory of 1432	1456	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe	80
PID 1432 wrote to memory of 776	1432	rundll32.exe	9
PID 1432 wrote to memory of 784	1432	rundll32.exe	10
PID 1432 wrote to memory of 1016	1432	rundll32.exe	13
PID 1432 wrote to memory of 2888	1432	rundll32.exe	49
PID 1432 wrote to memory of 3004	1432	rundll32.exe	51
PID 1432 wrote to memory of 428	1432	rundll32.exe	53
PID 1432 wrote to memory of 3412	1432	rundll32.exe	55
PID 1432 wrote to memory of 3580	1432	rundll32.exe	57
PID 1432 wrote to memory of 3764	1432	rundll32.exe	58
PID 1432 wrote to memory of 3860	1432	rundll32.exe	59
PID 1432 wrote to memory of 3924	1432	rundll32.exe	60
PID 1432 wrote to memory of 4000	1432	rundll32.exe	61
PID 1432 wrote to memory of 3568	1432	rundll32.exe	62
PID 1432 wrote to memory of 3076	1432	rundll32.exe	73
PID 1432 wrote to memory of 4932	1432	rundll32.exe	74

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1016

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3004

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3412
- C:\Users\Admin\AppData\Local\Temp\a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe
  "C:\Users\Admin\AppData\Local\Temp\a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1456
- - C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
    3⤵
    - Modifies firewall policy service
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Deletes itself
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3764

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3924

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4000

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3568

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3076

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rundll32.exe

Path C:\Users\Admin\AppData\Local\Temp\0E57421A_Rar\rundll32.exe
Size 664KB
SHA256 e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
MD5 2eb5d76180ce7b3241b281fa79ab3483
SHA1 06293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA512 35f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
SSDEEP 12288:DTyjXW+48qWywrU4kGFezOAVuJ5PIGww7F5DO3HYffS:fIXW/8yw1ez54lIYF5SXYHS
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
Size 740KB
SHA256 a9b2c4abe77c59be6c8c435d4b670e1df332e3e557deb0608fb61f8264a7200f
MD5 e530024da0fb81b9834730e53d7734b1
SHA1 fd339c16a5e490e1b16d102a23f862200f7c7067
SHA512 433cd6d80b556b6cf96e94e73dacd3ac2036cea4b67feffa05ccce0f5595c6dfe83b57541ea4e39d641d85101de5f66dcd36c5ff1428e8b1f0163b92256f4cae
SSDEEP 12288:VTyjXW+48qWywrU4kGFezOAVuJ5PILww7F5DO3HYffsxmZ+B:ZIXW/8yw1ez54lInF5SXYHqma
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYSTEM.INI

Path C:\Windows\SYSTEM.INI
Size 257B
SHA256 66e741efdcea1cae69be820497bb66374139cdcfd5da26fc674f27117c98201a
MD5 928cc1ece0b48c979bad9a6e691e7579
SHA1 5c25c793b2d2520b28d0c658203a8e5feb6765ce
SHA512 e91f82117d8fc426da9139a04b733cc440880361d329bf0d0fad4230cfe1e2c02b4e322a86870c3ba1dc3a8f0fa94e38a57b18e40699829a3b684049f3723262
MD5 SHA1 SHA512

Submit Download

lglme.pif

Path C:\lglme.pif
Size 100KB
SHA256 34067c9f1011e5ad5b0bf3e6a6cfdbd51e9a0b8005318daf23648c4dd27c23cd
MD5 98924af7e5533adee80b756cb522a228
SHA1 284b48e4f2488358b1d3b29d4da0ea3849b23b5f
SHA512 de68ca12d3dd5753b273bc880674f0ffd9f4d02ae5e6f2b7ef7b788363f704dda63e6654d180bf4f0b912712ad087329462bb9d930ce3f9247ba4b74d94ad276
SSDEEP 3072:zPfRaf57/g5djPSYQMVRN1alaSXE8JxELVgR:gfR/Sd+YT/aZXE5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1432-66-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-143-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-142-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/1432-113-0x00000000074F0000-0x00000000074F2000-memory.dmp

Download

memory/1432-102-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-85-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-74-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-73-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-58-0x00000000074F0000-0x00000000074F2000-memory.dmp

Download

memory/1432-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-54-0x0000000007A40000-0x0000000007A41000-memory.dmp

Download

memory/1432-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-57-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-60-0x00000000074F0000-0x00000000074F2000-memory.dmp

Download

memory/1432-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1432-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmp

Download

memory/1456-34-0x00000000075F0000-0x00000000075F2000-memory.dmp

Download

memory/1456-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/1456-15-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-4-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-24-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-6-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-42-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/1456-30-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-10-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-21-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-20-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-13-0x0000000007A40000-0x0000000007A41000-memory.dmp

Download

memory/1456-7-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-12-0x00000000075F0000-0x00000000075F2000-memory.dmp

Download

memory/1456-14-0x00000000075F0000-0x00000000075F2000-memory.dmp

Download

memory/1456-17-0x00000000075F0000-0x00000000075F2000-memory.dmp

Download

memory/1456-18-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-1-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-16-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download

memory/1456-5-0x0000000002E90000-0x0000000003F1E000-memory.dmp

Download