Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27d5636755b00a123fd0b41662ba565a25f980fdef3a3b706b010c370b9d65ad.dll
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
General
-
Target
27d5636755b00a123fd0b41662ba565a25f980fdef3a3b706b010c370b9d65ad.dll
-
Size
120KB
-
MD5
dddb162faa7d4024f2f2cc25f6d12a6c
-
SHA1
943cbd7ee5afa75eefc140d871ec1964b9f950ab
-
SHA256
27d5636755b00a123fd0b41662ba565a25f980fdef3a3b706b010c370b9d65ad
-
SHA512
e2f52d8b88f3099e365038c6115a8d82f7c1494910d494056f08bbf47dcf6da54083dd11f0f727351c7d51ce855be3f601524f7c2e007a8b5f924aac03269ccd
-
SSDEEP
1536:uTqLL4zXLmUqbv8tg13E00SuKa2jGPdSdEdHtxBqmO+dQKuCxdKm+IngH1b6Ow:uTqEbB4vJ13E0buVH1HxdT5H01b6
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a827.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578c81.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578c81.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a827.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a827.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578c81.exe -
Executes dropped EXE 4 IoCs
pid Process 4208 e578c81.exe 2816 e578e55.exe 2192 e57a807.exe 5096 e57a827.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578c81.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578c81.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a827.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a827.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a827.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: e578c81.exe File opened (read-only) \??\S: e578c81.exe File opened (read-only) \??\G: e578c81.exe File opened (read-only) \??\M: e578c81.exe File opened (read-only) \??\P: e578c81.exe File opened (read-only) \??\O: e578c81.exe File opened (read-only) \??\E: e578c81.exe File opened (read-only) \??\H: e578c81.exe File opened (read-only) \??\I: e578c81.exe File opened (read-only) \??\Q: e578c81.exe File opened (read-only) \??\E: e57a827.exe File opened (read-only) \??\J: e578c81.exe File opened (read-only) \??\K: e578c81.exe File opened (read-only) \??\L: e578c81.exe File opened (read-only) \??\N: e578c81.exe -
resource yara_rule behavioral2/memory/4208-6-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-8-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-9-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-10-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-11-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-27-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-12-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-29-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-31-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-35-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-36-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-37-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-38-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-39-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-41-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-40-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-43-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-44-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-58-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-60-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-61-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-75-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-77-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-80-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-83-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-84-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-87-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-88-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-92-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-93-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4208-97-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/5096-123-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/5096-165-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e578c81.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e578c81.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e578c81.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578c81.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57ddbd e57a827.exe File created C:\Windows\e578d2c e578c81.exe File opened for modification C:\Windows\SYSTEM.INI e578c81.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578c81.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578e55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a807.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a827.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4208 e578c81.exe 4208 e578c81.exe 4208 e578c81.exe 4208 e578c81.exe 5096 e57a827.exe 5096 e57a827.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe Token: SeDebugPrivilege 4208 e578c81.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 2552 3420 rundll32.exe 82 PID 3420 wrote to memory of 2552 3420 rundll32.exe 82 PID 3420 wrote to memory of 2552 3420 rundll32.exe 82 PID 2552 wrote to memory of 4208 2552 rundll32.exe 83 PID 2552 wrote to memory of 4208 2552 rundll32.exe 83 PID 2552 wrote to memory of 4208 2552 rundll32.exe 83 PID 4208 wrote to memory of 780 4208 e578c81.exe 8 PID 4208 wrote to memory of 788 4208 e578c81.exe 9 PID 4208 wrote to memory of 64 4208 e578c81.exe 13 PID 4208 wrote to memory of 2156 4208 e578c81.exe 50 PID 4208 wrote to memory of 2368 4208 e578c81.exe 51 PID 4208 wrote to memory of 3136 4208 e578c81.exe 53 PID 4208 wrote to memory of 3424 4208 e578c81.exe 56 PID 4208 wrote to memory of 3556 4208 e578c81.exe 57 PID 4208 wrote to memory of 3736 4208 e578c81.exe 58 PID 4208 wrote to memory of 3852 4208 e578c81.exe 59 PID 4208 wrote to memory of 3912 4208 e578c81.exe 60 PID 4208 wrote to memory of 4028 4208 e578c81.exe 61 PID 4208 wrote to memory of 3964 4208 e578c81.exe 62 PID 4208 wrote to memory of 4900 4208 e578c81.exe 74 PID 4208 wrote to memory of 2796 4208 e578c81.exe 76 PID 4208 wrote to memory of 3420 4208 e578c81.exe 81 PID 4208 wrote to memory of 2552 4208 e578c81.exe 82 PID 4208 wrote to memory of 2552 4208 e578c81.exe 82 PID 2552 wrote to memory of 2816 2552 rundll32.exe 84 PID 2552 wrote to memory of 2816 2552 rundll32.exe 84 PID 2552 wrote to memory of 2816 2552 rundll32.exe 84 PID 2552 wrote to memory of 2192 2552 rundll32.exe 85 PID 2552 wrote to memory of 2192 2552 rundll32.exe 85 PID 2552 wrote to memory of 2192 2552 rundll32.exe 85 PID 2552 wrote to memory of 5096 2552 rundll32.exe 86 PID 2552 wrote to memory of 5096 2552 rundll32.exe 86 PID 2552 wrote to memory of 5096 2552 rundll32.exe 86 PID 4208 wrote to memory of 780 4208 e578c81.exe 8 PID 4208 wrote to memory of 788 4208 e578c81.exe 9 PID 4208 wrote to memory of 64 4208 e578c81.exe 13 PID 4208 wrote to memory of 2156 4208 e578c81.exe 50 PID 4208 wrote to memory of 2368 4208 e578c81.exe 51 PID 4208 wrote to memory of 3136 4208 e578c81.exe 53 PID 4208 wrote to memory of 3424 4208 e578c81.exe 56 PID 4208 wrote to memory of 3556 4208 e578c81.exe 57 PID 4208 wrote to memory of 3736 4208 e578c81.exe 58 PID 4208 wrote to memory of 3852 4208 e578c81.exe 59 PID 4208 wrote to memory of 3912 4208 e578c81.exe 60 PID 4208 wrote to memory of 4028 4208 e578c81.exe 61 PID 4208 wrote to memory of 3964 4208 e578c81.exe 62 PID 4208 wrote to memory of 4900 4208 e578c81.exe 74 PID 4208 wrote to memory of 2796 4208 e578c81.exe 76 PID 4208 wrote to memory of 2816 4208 e578c81.exe 84 PID 4208 wrote to memory of 2816 4208 e578c81.exe 84 PID 4208 wrote to memory of 2192 4208 e578c81.exe 85 PID 4208 wrote to memory of 2192 4208 e578c81.exe 85 PID 4208 wrote to memory of 5096 4208 e578c81.exe 86 PID 4208 wrote to memory of 5096 4208 e578c81.exe 86 PID 5096 wrote to memory of 780 5096 e57a827.exe 8 PID 5096 wrote to memory of 788 5096 e57a827.exe 9 PID 5096 wrote to memory of 64 5096 e57a827.exe 13 PID 5096 wrote to memory of 2156 5096 e57a827.exe 50 PID 5096 wrote to memory of 2368 5096 e57a827.exe 51 PID 5096 wrote to memory of 3136 5096 e57a827.exe 53 PID 5096 wrote to memory of 3424 5096 e57a827.exe 56 PID 5096 wrote to memory of 3556 5096 e57a827.exe 57 PID 5096 wrote to memory of 3736 5096 e57a827.exe 58 PID 5096 wrote to memory of 3852 5096 e57a827.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578c81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a827.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2368
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3136
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27d5636755b00a123fd0b41662ba565a25f980fdef3a3b706b010c370b9d65ad.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27d5636755b00a123fd0b41662ba565a25f980fdef3a3b706b010c370b9d65ad.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\e578c81.exeC:\Users\Admin\AppData\Local\Temp\e578c81.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4208
-
-
C:\Users\Admin\AppData\Local\Temp\e578e55.exeC:\Users\Admin\AppData\Local\Temp\e578e55.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\e57a807.exeC:\Users\Admin\AppData\Local\Temp\e57a807.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\e57a827.exeC:\Users\Admin\AppData\Local\Temp\e57a827.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5096
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3964
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4900
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2796
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD55e742f48652da98cdaa691a11f8de554
SHA15419fcde519912ee0240234bb8f177ebf3131f81
SHA256a763d5787b31cf6ad54caa3bc47d2d6179c9a8180d849eafae9884b1c3134ef6
SHA512a9ca8a709393c97703700655895af0479f6795ccfc5bb2002f604da2cb21eeaa994cacca9f934adb034fe054bdae0483d723b04431305fa4b473ceeccefbf22b
-
Filesize
257B
MD5727808ba3d624321b4765c9c4a9ccd33
SHA10be05cb425defaf2c7038dbf9a29354c2acad53a
SHA2565c462a7c9a684139e3702ec121407299bc19fbd128edb03cb2ed4d49f2c04817
SHA512ecb2ab3ea772f3598764b5270aac7e7f213ff79299f570aa8eda255ecf4db3aad6acc2c2968a058f3781ef54d63671fe6cde5e5450bc97bb171cec9ef4459554