Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 18:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1576ed17d3c7dbcfc9c3b3a871b087c528761a5d7cc886d6e4ead0941f4192cd.dll
Resource
win7-20240611-en
windows7-x64
15 signatures
150 seconds
General
- Target 1576ed17d3c7dbcfc9c3b3a871b087c528761a5d7cc886d6e4ead0941f4192cd.dll
- Size 120KB
- Sample240621-xm2avsteml
- SHA256 1576ed17d3c7dbcfc9c3b3a871b087c528761a5d7cc886d6e4ead0941f4192cd
- MD5 06fc84c23f49d3ce7228d747222f5adc
- SHA1 bd3fd101c976d872de4d80c4db7b687e2fcfa340
- SHA512 136bec55daa8723f79b6520d8d9f25d15a274278fad3a338af28c773910f36d166bd494fe924499a5fafd0b8a6f662334a8daedc5683cb1c1392b1ca5b6a568d
- SSDEEP 3072:HfrQZewWi/qsIwloE7i+aJlfYB/5hGbt+Sq:/r0ewWiH2++lfYBha
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5763da.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5763da.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576580.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576580.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578201.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578201.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578201.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576580.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576580.exe - Executes dropped EXE 4 IoCs
pid Process 2108 e5763da.exe 4244 e576580.exe 1080 e578201.exe 4652 e578220.exe -
resource yara_rule behavioral2/memory/2108-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-10-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-14-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-23-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-24-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-29-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-13-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-33-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-37-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-38-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-39-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-54-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-55-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-56-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-70-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-71-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-73-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-75-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-78-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-79-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-81-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-82-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-83-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-90-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-93-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2108-97-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4244-124-0x0000000000B90000-0x0000000001C4A000-memory.dmp upx behavioral2/memory/4244-148-0x0000000000B90000-0x0000000001C4A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578201.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576580.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576580.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578201.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578201.exe - Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e5763da.exe File opened (read-only) \??\G: e5763da.exe File opened (read-only) \??\I: e5763da.exe File opened (read-only) \??\K: e5763da.exe File opened (read-only) \??\L: e5763da.exe File opened (read-only) \??\M: e5763da.exe File opened (read-only) \??\O: e5763da.exe File opened (read-only) \??\H: e5763da.exe File opened (read-only) \??\J: e5763da.exe File opened (read-only) \??\N: e5763da.exe File opened (read-only) \??\P: e5763da.exe File opened (read-only) \??\Q: e5763da.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e5763da.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5763da.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5763da.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e576428 e5763da.exe File opened for modification C:\Windows\SYSTEM.INI e5763da.exe File created C:\Windows\e57b4f8 e576580.exe File created C:\Windows\e57d060 e578201.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2108 e5763da.exe 2108 e5763da.exe 2108 e5763da.exe 2108 e5763da.exe 4244 e576580.exe 4244 e576580.exe 1080 e578201.exe 1080 e578201.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe Token: SeDebugPrivilege 2108 e5763da.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4104 wrote to memory of 4712 4104 rundll32.exe 81 PID 4104 wrote to memory of 4712 4104 rundll32.exe 81 PID 4104 wrote to memory of 4712 4104 rundll32.exe 81 PID 4712 wrote to memory of 2108 4712 rundll32.exe 82 PID 4712 wrote to memory of 2108 4712 rundll32.exe 82 PID 4712 wrote to memory of 2108 4712 rundll32.exe 82 PID 2108 wrote to memory of 792 2108 e5763da.exe 8 PID 2108 wrote to memory of 800 2108 e5763da.exe 9 PID 2108 wrote to memory of 380 2108 e5763da.exe 13 PID 2108 wrote to memory of 2720 2108 e5763da.exe 49 PID 2108 wrote to memory of 2728 2108 e5763da.exe 50 PID 2108 wrote to memory of 2960 2108 e5763da.exe 51 PID 2108 wrote to memory of 3520 2108 e5763da.exe 56 PID 2108 wrote to memory of 3644 2108 e5763da.exe 57 PID 2108 wrote to memory of 3840 2108 e5763da.exe 58 PID 2108 wrote to memory of 4012 2108 e5763da.exe 59 PID 2108 wrote to memory of 4072 2108 e5763da.exe 60 PID 2108 wrote to memory of 3872 2108 e5763da.exe 61 PID 2108 wrote to memory of 4124 2108 e5763da.exe 62 PID 2108 wrote to memory of 392 2108 e5763da.exe 64 PID 2108 wrote to memory of 2292 2108 e5763da.exe 75 PID 2108 wrote to memory of 4104 2108 e5763da.exe 80 PID 2108 wrote to memory of 4712 2108 e5763da.exe 81 PID 2108 wrote to memory of 4712 2108 e5763da.exe 81 PID 4712 wrote to memory of 4244 4712 rundll32.exe 83 PID 4712 wrote to memory of 4244 4712 rundll32.exe 83 PID 4712 wrote to memory of 4244 4712 rundll32.exe 83 PID 4712 wrote to memory of 1080 4712 rundll32.exe 84 PID 4712 wrote to memory of 1080 4712 rundll32.exe 84 PID 4712 wrote to memory of 1080 4712 rundll32.exe 84 PID 4712 wrote to memory of 4652 4712 rundll32.exe 85 PID 4712 wrote to memory of 4652 4712 rundll32.exe 85 PID 4712 wrote to memory of 4652 4712 rundll32.exe 85 PID 2108 wrote to memory of 792 2108 e5763da.exe 8 PID 2108 wrote to memory of 800 2108 e5763da.exe 9 PID 2108 wrote to memory of 380 2108 e5763da.exe 13 PID 2108 wrote to memory of 2720 2108 e5763da.exe 49 PID 2108 wrote to memory of 2728 2108 e5763da.exe 50 PID 2108 wrote to memory of 2960 2108 e5763da.exe 51 PID 2108 wrote to memory of 3520 2108 e5763da.exe 56 PID 2108 wrote to memory of 3644 2108 e5763da.exe 57 PID 2108 wrote to memory of 3840 2108 e5763da.exe 58 PID 2108 wrote to memory of 4012 2108 e5763da.exe 59 PID 2108 wrote to memory of 4072 2108 e5763da.exe 60 PID 2108 wrote to memory of 3872 2108 e5763da.exe 61 PID 2108 wrote to memory of 4124 2108 e5763da.exe 62 PID 2108 wrote to memory of 392 2108 e5763da.exe 64 PID 2108 wrote to memory of 2292 2108 e5763da.exe 75 PID 2108 wrote to memory of 4244 2108 e5763da.exe 83 PID 2108 wrote to memory of 4244 2108 e5763da.exe 83 PID 2108 wrote to memory of 1080 2108 e5763da.exe 84 PID 2108 wrote to memory of 1080 2108 e5763da.exe 84 PID 2108 wrote to memory of 4652 2108 e5763da.exe 85 PID 2108 wrote to memory of 4652 2108 e5763da.exe 85 PID 4244 wrote to memory of 792 4244 e576580.exe 8 PID 4244 wrote to memory of 800 4244 e576580.exe 9 PID 4244 wrote to memory of 380 4244 e576580.exe 13 PID 4244 wrote to memory of 2720 4244 e576580.exe 49 PID 4244 wrote to memory of 2728 4244 e576580.exe 50 PID 4244 wrote to memory of 2960 4244 e576580.exe 51 PID 4244 wrote to memory of 3520 4244 e576580.exe 56 PID 4244 wrote to memory of 3644 4244 e576580.exe 57 PID 4244 wrote to memory of 3840 4244 e576580.exe 58 PID 4244 wrote to memory of 4012 4244 e576580.exe 59 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5763da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578201.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2728
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2960
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1576ed17d3c7dbcfc9c3b3a871b087c528761a5d7cc886d6e4ead0941f4192cd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1576ed17d3c7dbcfc9c3b3a871b087c528761a5d7cc886d6e4ead0941f4192cd.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\e5763da.exeC:\Users\Admin\AppData\Local\Temp\e5763da.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\e576580.exeC:\Users\Admin\AppData\Local\Temp\e576580.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\e578201.exeC:\Users\Admin\AppData\Local\Temp\e578201.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1080
-
-
C:\Users\Admin\AppData\Local\Temp\e578220.exeC:\Users\Admin\AppData\Local\Temp\e578220.exe4⤵
- Executes dropped EXE
PID:4652
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3644
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3840
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4072
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3872
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:392
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2292
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5763da.exe
- Size 97KB
- SHA256 30b84772d8500c0a29c02aa541710e413fcc5b57cde11c11ff51d906836bae46
- MD5 78fcd9df65c1810e6dd2580267b81a26
- SHA1 4439c9e98635876593dcae701cf6b537f7ac91e8
- SHA512 b4b2b51d2baa3e1bde95fd286af5f5dc7a2a7cd277df7075ab29b488565bc2426df85e8eed62e48008598898fbcee7275e9519caa57b85e106845ac9ead8b0f2
- SSDEEP 1536:nLCFeBDxEq9ktNdkXkgnOvmU0nf069l2VGIa9ThZo7d8tRC4VW:GFeByqSWXNptHuQICeJ4VW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 e1bcfd131a5a28631b6a084b64cbaa4a4f95a819b116983aaf4321ae41a8b57e
- MD5 360ab47ddf65e12e00e4fedf8548008b
- SHA1 3572fb2cbeeb2835f4ab594d6a2b5e755000a46d
- SHA512 8c5e66afee895f1b3c8234b49895a849587a447db84161f6b22bf1f6572d42335018ec88a17ade9c4ceeddc8544cfb4bae5450c3bddda1a6303ed23ddff1f4d8
- MD5 SHA1 SHA512