Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 23:49
Static task
static1
Behavioral task
behavioral1
Sample
2a6c47495f41d04ac9a1152eb6c35ac0N.exe
Resource
win7-20240708-en
General
-
Target
2a6c47495f41d04ac9a1152eb6c35ac0N.exe
-
Size
3.0MB
-
MD5
2a6c47495f41d04ac9a1152eb6c35ac0
-
SHA1
f8bc21998e8ad7d16d160524d9fc1093374c0c8f
-
SHA256
ce58e9ff0ae46c370ca243ac0e7b09fc08628c92af053b3b293cd641907fed02
-
SHA512
710205ae407e38cddf03b5fc244e735609e6266038ad60f2a0a521d32988a84e4c9a09ee196eeed88b7f2d98d12ac69e09a2e91be7b0c475f3ade30d752dde63
-
SSDEEP
49152:LMLeP19bEQBeI0BawEjSghQO+eejCXnTRhApjDRNqAe/l3YjG:ALeP19gQI1BJEjP+eiC3thy4xYjG
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
resource yara_rule behavioral2/memory/1936-1-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/1936-5-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/1936-4-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/1936-12-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/1936-13-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/1936-6-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/1936-3-0x0000000002600000-0x000000000368E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe Token: SeDebugPrivilege 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1936 wrote to memory of 812 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 9 PID 1936 wrote to memory of 808 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 10 PID 1936 wrote to memory of 384 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 13 PID 1936 wrote to memory of 2492 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 51 PID 1936 wrote to memory of 3092 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 52 PID 1936 wrote to memory of 3156 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 53 PID 1936 wrote to memory of 3428 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 56 PID 1936 wrote to memory of 3536 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 57 PID 1936 wrote to memory of 3732 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 58 PID 1936 wrote to memory of 3828 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 59 PID 1936 wrote to memory of 3888 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 60 PID 1936 wrote to memory of 3964 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 61 PID 1936 wrote to memory of 3152 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 62 PID 1936 wrote to memory of 1528 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 74 PID 1936 wrote to memory of 2128 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 76 PID 1936 wrote to memory of 4712 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 81 PID 1936 wrote to memory of 2052 1936 2a6c47495f41d04ac9a1152eb6c35ac0N.exe 82 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2a6c47495f41d04ac9a1152eb6c35ac0N.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3092
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2a6c47495f41d04ac9a1152eb6c35ac0N.exe"C:\Users\Admin\AppData\Local\Temp\2a6c47495f41d04ac9a1152eb6c35ac0N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1936
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3536
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3828
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3964
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3152
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1528
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2128
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4712
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2052
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1