Malware Analysis Report

2024-11-16 13:15

Sample ID 240625-et8dmszdqb
Target f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4
SHA256 f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4

Threat Level: Known bad

The file f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Modifies firewall policy service

Windows security bypass

Sality

UAC bypass

Executes dropped EXE

Loads dropped DLL

Windows security modification

Deletes itself

UPX packed file

Checks whether UAC is enabled

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Runs net.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 04:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 04:15

Reported

2024-06-25 04:17

Platform

win7-20240611-en

Max time kernel

150s

Max time network

124s

Command Line

C:\Windows\Explorer.EXE

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Services\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Journal\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File created C:\Windows\vDll.dll C:\Windows\Logo1_.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 2252 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 2252 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 2252 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 2360 wrote to memory of 2588 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2360 wrote to memory of 2588 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2360 wrote to memory of 2588 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2360 wrote to memory of 2588 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2588 wrote to memory of 2720 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2588 wrote to memory of 2720 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2588 wrote to memory of 2720 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2588 wrote to memory of 2720 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2200 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2200 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2200 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2200 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2648 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2668 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2668 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2668 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 2360 wrote to memory of 1216 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2360 wrote to memory of 1216 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe

"C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe

"C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$a901F.bat

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe

"C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe"

Network

N/A

Files

memory/2252-0-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat

MD5 3244d47f44ae28ace8b8839d1e83ff77
SHA1 a72065d698b8381bdd0c30c4d7394658d2203369
SHA256 58e88ed3ca12cfeb0ab060bbe6f209a2753a3d2fc4893231e7a6fff430e7efd7
SHA512 fc00cafbc23903665433da5df3c522540c4dec8d91661c164b269e3edab9d874de57e78994af7d990213d7fd04c867dcfc74a8e47d32c41d45580593f5d2577a

C:\Windows\rundl132.exe

MD5 3992018359c15d0314fdd929a93f6de6
SHA1 f555c42a2d4e15a428a549ac4a6efd625dca9f1d
SHA256 29351c1cb276aa4bd87e3e0c7aed4808a2c80cad99b26b8be984350aeeee2b48
SHA512 236360097d9fe4f693a17d4b7e9d08d4f017019eba021e17217ba1486a6ecaa1a1ad54c93a3819d84b5af2bbeb3096b81ef8e055fd973954323cfcd7107f7dc2

memory/2360-18-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2252-16-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe.exe

MD5 746a08cc0ee3ff9977f32dd1d4e677cf
SHA1 1082388d1a68b9ded51e99bbb3bf320c8dd3d22c
SHA256 6e822ceadc275d174e9501b985ae1d7d915631f1bfcc98c40e0b524c7569e348
SHA512 100ed406490a9e9b470b7a0f754bfab4c7a4705d5a207cf648a687a53e0774c91e19a410ede176126601afaa45a01becc8940ec97164dded52de3c26459f4eec

memory/2648-31-0x0000000000400000-0x0000000000445000-memory.dmp

memory/2200-30-0x0000000000140000-0x0000000000185000-memory.dmp

memory/2200-27-0x0000000000140000-0x0000000000185000-memory.dmp

C:\Windows\rundl132.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2648-34-0x00000000005D0000-0x000000000168A000-memory.dmp

memory/2648-44-0x0000000000400000-0x0000000000445000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a901F.bat

MD5 a5914d34be363a05f34cee783872e699
SHA1 ba8b28b08b367fc0dc7bdfa6338249156c4131f5
SHA256 79860ba8ded600311ef32e9e3c6f3f1e668116a05a605d93a14b38eb77fa8b38
SHA512 c0087c0ed36b51ea41d3305553237a1dc8c3ee943b8004173e8314bf7c309dfa7b331a2528de8475722abfbb2f3bf5df3b4d9ec0c465b46f525756175bd0a8e8

memory/2648-45-0x00000000005D0000-0x000000000168A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe.exe

MD5 287cbb270c4354cadc055be9d867dc11
SHA1 619b682ffc46fb5bf74b7207af188d7e289001f0
SHA256 83d2154e6ae6cd9ff0d956e41bea07b91e6e4919efd0c74f371535f737240567
SHA512 b47e161493ce5a5bc7969ce2ab8161ae2a562536e331e3214149b4559222182fda6770716f5936ec659b877fc351f1a927d22cd978f1cd365241014ee47b282b

memory/2668-52-0x0000000000400000-0x0000000000447000-memory.dmp

memory/2668-51-0x0000000000400000-0x0000000000447000-memory.dmp

memory/2496-53-0x0000000000400000-0x0000000000447000-memory.dmp

memory/1216-55-0x0000000002160000-0x0000000002161000-memory.dmp

memory/2360-59-0x0000000000400000-0x0000000000435000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-39690363-730359138-1046745555-1000\_desktop.ini

MD5 350287db1fc609b4af3d4be72fe4335c
SHA1 38a39d9ba5ef191ae67da93eb45fa75d6bf0fa74
SHA256 0080af51fe800ee1ee3747e3385cce9817b9e186608ee852626f021df5ae7b2b
SHA512 7bb2636ff54fde68a2957dd803185edb83a35f5f56bdd465bc1dec20e897ebfaa71552859b7cff0eb601d9e8d2a426b93e7c4057429d3862d06a09e439f53fc8

memory/2360-66-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2360-72-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2360-118-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2360-124-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2360-1902-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 667779f0573e09ee14120a39fa88225e
SHA1 2c937fd4db0b82599d153b705902ff373c67af41
SHA256 1fc2b580c675acf35608bd23b13b90459c9421222d9be15812db36c16d4850f3
SHA512 f3b6b7dac69e47b0cb201cabe4ce0ee7489de981c1b0cf6b57be64a0831473f844de8b5b36b0f2ac1ac13f69f367e388f96f1283f39ead23c3aabf4e7bc3fe99

memory/2360-3362-0x0000000000400000-0x0000000000435000-memory.dmp

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 88eb1bca8c399bc3f46e99cdde2f047e
SHA1 55fafbceb011e1af2edced978686a90971bd95f2
SHA256 42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428
SHA512 149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 04:15

Reported

2024-06-25 04:17

Platform

win10v2004-20240508-en

Max time kernel

24s

Max time network

83s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\Logo1_.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Logo1_.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Logo1_.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File created C:\Windows\e574798 C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\vDll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\e5744ba C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
File created C:\Windows\e576c66 C:\Windows\Logo1_.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2116 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2116 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2116 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 2116 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 2116 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 2116 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 924 wrote to memory of 2428 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 924 wrote to memory of 2428 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 924 wrote to memory of 2428 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2428 wrote to memory of 4136 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2428 wrote to memory of 4136 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2428 wrote to memory of 4136 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1912 wrote to memory of 1092 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 1912 wrote to memory of 1092 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 1912 wrote to memory of 1092 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 1092 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\dwm.exe
PID 1092 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\sihost.exe
PID 1092 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\taskhostw.exe
PID 1092 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Explorer.EXE
PID 1092 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\system32\DllHost.exe
PID 1092 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1092 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\System32\RuntimeBroker.exe
PID 1092 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1092 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\System32\RuntimeBroker.exe
PID 1092 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\System32\RuntimeBroker.exe
PID 1092 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1092 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 1092 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\Logo1_.exe
PID 1092 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\System32\Conhost.exe
PID 1092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\fontdrvhost.exe
PID 1912 wrote to memory of 780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\fontdrvhost.exe
PID 1912 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\dwm.exe
PID 1912 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\sihost.exe
PID 1912 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 1912 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\taskhostw.exe
PID 1912 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 1912 wrote to memory of 3824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\DllHost.exe
PID 1912 wrote to memory of 3916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1912 wrote to memory of 3984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 1912 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1912 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 1912 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 1912 wrote to memory of 4744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1912 wrote to memory of 468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\Conhost.exe
PID 1912 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\Conhost.exe
PID 1016 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 1016 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 1016 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe
PID 924 wrote to memory of 3528 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 924 wrote to memory of 3528 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 924 wrote to memory of 776 N/A C:\Windows\Logo1_.exe C:\Windows\system32\fontdrvhost.exe
PID 924 wrote to memory of 780 N/A C:\Windows\Logo1_.exe C:\Windows\system32\fontdrvhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe

"C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42D5.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe

"C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4527.bat

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe

"C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/2116-2-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Windows\Logo1_.exe

MD5 3992018359c15d0314fdd929a93f6de6
SHA1 f555c42a2d4e15a428a549ac4a6efd625dca9f1d
SHA256 29351c1cb276aa4bd87e3e0c7aed4808a2c80cad99b26b8be984350aeeee2b48
SHA512 236360097d9fe4f693a17d4b7e9d08d4f017019eba021e17217ba1486a6ecaa1a1ad54c93a3819d84b5af2bbeb3096b81ef8e055fd973954323cfcd7107f7dc2

memory/2116-13-0x0000000000400000-0x0000000000435000-memory.dmp

memory/924-12-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a42D5.bat

MD5 6cca8f5177098ce20aabe23ac4cab9cd
SHA1 9b79814d35bc9fef9950de9d19000c074eb14dc3
SHA256 69ef292749ae46f8f25af249765af78105d8e335e44b0b6085f53d817186f67b
SHA512 9b12a0b610de380b892c74135dc8f71e364e157b5bbaeaf149ae90eee6e479167853e8f93f193ebb38f4552057b5ccda337460dfada953de1c08325934872a77

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe.exe

MD5 746a08cc0ee3ff9977f32dd1d4e677cf
SHA1 1082388d1a68b9ded51e99bbb3bf320c8dd3d22c
SHA256 6e822ceadc275d174e9501b985ae1d7d915631f1bfcc98c40e0b524c7569e348
SHA512 100ed406490a9e9b470b7a0f754bfab4c7a4705d5a207cf648a687a53e0774c91e19a410ede176126601afaa45a01becc8940ec97164dded52de3c26459f4eec

memory/1092-19-0x0000000000400000-0x0000000000445000-memory.dmp

memory/1092-21-0x00000000007A0000-0x000000000185A000-memory.dmp

memory/1092-20-0x00000000007A0000-0x000000000185A000-memory.dmp

memory/1092-23-0x00000000007A0000-0x000000000185A000-memory.dmp

C:\Windows\rundl132.exe

MD5 5b3f798bbcf32cb0804f171f43fb9f19
SHA1 fc76e4c2eab0edaa19b1dcdcf93f8a30ff9cf2b8
SHA256 5b3dba5a1f30bc6b63da8ec4e22a04ef61c49bc31ff5d8734bd31ba4a748a296
SHA512 9c18ac7ddc737dcd0f83883bfdba5861a29ccaa5c050e31ec6af4d529ba5b0e42678e870ebccccacbb02e628a1d964eb3007b1173f889a4470a374a0783a44f3

memory/1016-39-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/1092-37-0x0000000003E30000-0x0000000003E31000-memory.dmp

memory/924-35-0x0000000000690000-0x0000000000691000-memory.dmp

memory/924-34-0x0000000000550000-0x0000000000552000-memory.dmp

memory/1912-32-0x00000000011C0000-0x00000000011C1000-memory.dmp

memory/1912-31-0x0000000001170000-0x0000000001172000-memory.dmp

memory/1092-24-0x00000000007A0000-0x000000000185A000-memory.dmp

memory/924-40-0x0000000000550000-0x0000000000552000-memory.dmp

memory/1092-30-0x00000000007A0000-0x000000000185A000-memory.dmp

memory/1092-45-0x00000000007A0000-0x000000000185A000-memory.dmp

memory/1092-48-0x0000000000400000-0x0000000000445000-memory.dmp

memory/1912-49-0x0000000001170000-0x0000000001172000-memory.dmp

memory/1912-50-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1912-51-0x0000000001170000-0x0000000001172000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 71db8b2e3fe9b9f240c3765059ac1828
SHA1 215e7d562d26309b1bb23bfb9c68e2a248d47367
SHA256 088ec0d97e724e91b7e2d8957fe2ed218b02c5b8aafda647423bbf6655e3a41b
SHA512 96f63fbb84bfd1365292a69a94266c8f02ec07aec9d4f037b07228c78254003cf4da276dd18950c21b9d24d035fa0cab62926de69c6733d6c3d4468f7a92c468

memory/1912-53-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1016-56-0x0000000000380000-0x0000000000382000-memory.dmp

memory/1016-57-0x0000000000380000-0x0000000000382000-memory.dmp

memory/1912-55-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1912-54-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1912-60-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1912-58-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1912-59-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1912-61-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1912-63-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1368-67-0x0000000000400000-0x0000000000447000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f374ea6681cbfb58673ebc7526d94b9a204e6e25e8abfc690e94d2051301b5d4.exe

MD5 287cbb270c4354cadc055be9d867dc11
SHA1 619b682ffc46fb5bf74b7207af188d7e289001f0
SHA256 83d2154e6ae6cd9ff0d956e41bea07b91e6e4919efd0c74f371535f737240567
SHA512 b47e161493ce5a5bc7969ce2ab8161ae2a562536e331e3214149b4559222182fda6770716f5936ec659b877fc351f1a927d22cd978f1cd365241014ee47b282b

memory/1912-73-0x0000000001C30000-0x0000000002CEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a4527.bat

MD5 6bdc1bd6d1102d3d642ecbd342ea2f88
SHA1 6901f05c8db3320239a0735bacc6a8eb4087a869
SHA256 fa4f0e6ada402b4207022cbf7f98f7b6f7199d6a6755ce8b245d45db1b67a342
SHA512 53b3b33114e7c769923544ae1f464229e785bac6b974d5d3f9d1a6801af88b367826f1542cb033740bf0272baf4801cfdaddc7215417e099db087b1c2a8a735d

memory/1912-62-0x0000000001C30000-0x0000000002CEA000-memory.dmp

memory/1016-85-0x0000000000380000-0x0000000000382000-memory.dmp

memory/924-89-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-93-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-103-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-96-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-102-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-95-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-94-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-92-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-90-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-91-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-104-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-105-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-107-0x0000000000400000-0x0000000000435000-memory.dmp

memory/924-108-0x0000000003710000-0x00000000047CA000-memory.dmp

memory/924-109-0x0000000003710000-0x00000000047CA000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini

MD5 350287db1fc609b4af3d4be72fe4335c
SHA1 38a39d9ba5ef191ae67da93eb45fa75d6bf0fa74
SHA256 0080af51fe800ee1ee3747e3385cce9817b9e186608ee852626f021df5ae7b2b
SHA512 7bb2636ff54fde68a2957dd803185edb83a35f5f56bdd465bc1dec20e897ebfaa71552859b7cff0eb601d9e8d2a426b93e7c4057429d3862d06a09e439f53fc8

memory/924-136-0x0000000000550000-0x0000000000552000-memory.dmp

C:\iyjvvr.exe

MD5 05f1aaad22627c3bd9cbc4a940fc65e2
SHA1 ab9891199f44173219fb0dd2dbcfc76359eec056
SHA256 aa10d9a21898ca33925c15a384d3d996c1803c91e2e93c47e47728b23b593f4e
SHA512 a5123a572c764d6f9452d9b32f6468b2b482bc86540825b1a5128dc36716c752a11105e23bdff7593d7f2a296761869ca63c66d6298a54e4b300a7b10c7bbd9d

C:\Program Files\7-Zip\7z.exe

MD5 bf443202aa28f39e7c39ccda18a2ce00
SHA1 523a5b15315bb5023863c7fc9a166aa94c378ce8
SHA256 2a9023ed807f186bcc2e56b4d35b55919b464839bc61a3e59517863804a44f17
SHA512 4ce6d6323960ef7fde2931b76f26130c2f253af98d6f7cbcc77c3cf3e99610c9c23c4f38276c20f4c62778eb2744e84bf7b774e45f8afd9461f1937da8c679a2

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 667779f0573e09ee14120a39fa88225e
SHA1 2c937fd4db0b82599d153b705902ff373c67af41
SHA256 1fc2b580c675acf35608bd23b13b90459c9421222d9be15812db36c16d4850f3
SHA512 f3b6b7dac69e47b0cb201cabe4ce0ee7489de981c1b0cf6b57be64a0831473f844de8b5b36b0f2ac1ac13f69f367e388f96f1283f39ead23c3aabf4e7bc3fe99

memory/924-4954-0x0000000000400000-0x0000000000435000-memory.dmp