Malware Analysis Report

2025-06-16 06:56

Sample ID 241104-fhhjhswrhk
Target cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N
SHA256 cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827
Tags
sality backdoor discovery evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827

Threat Level: Known bad

The file cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N was found to be: Known bad.

Malicious Activity Summary

sality backdoor discovery evasion trojan upx

Sality

Windows security bypass

UAC bypass

Sality family

Modifies firewall policy service

Executes dropped EXE

Loads dropped DLL

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

UPX packed file

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-04 04:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-04 04:52

Reported

2024-11-04 04:55

Platform

win7-20240729-en

Max time kernel

29s

Max time network

21s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f77aef5 C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
File created C:\Windows\f775b69 C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2656 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2656 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2656 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2656 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2656 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2656 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2656 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2760 wrote to memory of 2940 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775a7f.exe
PID 2760 wrote to memory of 2940 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775a7f.exe
PID 2760 wrote to memory of 2940 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775a7f.exe
PID 2760 wrote to memory of 2940 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775a7f.exe
PID 2940 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\system32\taskhost.exe
PID 2940 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\system32\Dwm.exe
PID 2940 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\Explorer.EXE
PID 2940 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\system32\DllHost.exe
PID 2940 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\system32\rundll32.exe
PID 2940 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\SysWOW64\rundll32.exe
PID 2760 wrote to memory of 2580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775d2d.exe
PID 2760 wrote to memory of 2580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775d2d.exe
PID 2760 wrote to memory of 2580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775d2d.exe
PID 2760 wrote to memory of 2580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f775d2d.exe
PID 2760 wrote to memory of 2956 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f777d2b.exe
PID 2760 wrote to memory of 2956 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f777d2b.exe
PID 2760 wrote to memory of 2956 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f777d2b.exe
PID 2760 wrote to memory of 2956 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f777d2b.exe
PID 2940 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\system32\taskhost.exe
PID 2940 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\system32\Dwm.exe
PID 2940 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\Explorer.EXE
PID 2940 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Windows\system32\DllHost.exe
PID 2940 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Users\Admin\AppData\Local\Temp\f775d2d.exe
PID 2940 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Users\Admin\AppData\Local\Temp\f775d2d.exe
PID 2940 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Users\Admin\AppData\Local\Temp\f777d2b.exe
PID 2940 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\f775a7f.exe C:\Users\Admin\AppData\Local\Temp\f777d2b.exe
PID 2956 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe C:\Windows\system32\taskhost.exe
PID 2956 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe C:\Windows\system32\Dwm.exe
PID 2956 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe C:\Windows\Explorer.EXE
PID 2956 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\f777d2b.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f775a7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f777d2b.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#1

C:\Users\Admin\AppData\Local\Temp\f775a7f.exe

C:\Users\Admin\AppData\Local\Temp\f775a7f.exe

C:\Users\Admin\AppData\Local\Temp\f775d2d.exe

C:\Users\Admin\AppData\Local\Temp\f775d2d.exe

C:\Users\Admin\AppData\Local\Temp\f777d2b.exe

C:\Users\Admin\AppData\Local\Temp\f777d2b.exe

Network

N/A

Files

memory/2760-0-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2760-2-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2760-4-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2760-1-0x0000000010000000-0x0000000010020000-memory.dmp

\Users\Admin\AppData\Local\Temp\f775a7f.exe

MD5 3f4855e34ca66d4a8d94da47ea4b3cbc
SHA1 0ff399f134c2bd145b036be821422c2103d5edb0
SHA256 57aaf3e40638ea3b12e7c2b5626d777125d2a484ddefec767271132195842fb0
SHA512 42e89070a4dcdaae7368b3543a3bf5a7750872ac3405f66478def13d3a33db9799fee767c312fa1e13190ee9caee8db194e551631900bb868e04f6d6244a7be3

memory/2760-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2940-14-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2760-12-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2940-15-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2760-49-0x0000000000160000-0x0000000000162000-memory.dmp

memory/2580-53-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2940-51-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-39-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-54-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-38-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-50-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-20-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-19-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-18-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-37-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/2760-31-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2760-29-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2940-61-0x00000000002D0000-0x00000000002D2000-memory.dmp

memory/2940-60-0x00000000002D0000-0x00000000002D2000-memory.dmp

memory/2760-28-0x0000000000160000-0x0000000000162000-memory.dmp

memory/1104-21-0x0000000002020000-0x0000000002022000-memory.dmp

memory/2760-48-0x0000000000360000-0x0000000000372000-memory.dmp

memory/2760-47-0x0000000000160000-0x0000000000162000-memory.dmp

memory/2940-17-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-62-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-63-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-64-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-67-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2956-79-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2940-80-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2760-75-0x0000000000160000-0x0000000000162000-memory.dmp

memory/2956-95-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2956-97-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2580-96-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2940-81-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2956-94-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/2580-90-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2940-98-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-99-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-103-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-104-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-105-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-108-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-111-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2940-138-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2940-139-0x0000000000670000-0x000000000172A000-memory.dmp

memory/2580-143-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2956-145-0x0000000000900000-0x00000000019BA000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 06e7deb9e488c2d878e4a27e72fec05d
SHA1 1fde3cfff2e1fbb198317c8d39c9488caf8e91bb
SHA256 2751dcbac427f5e2ef1ace30a0e67d39685ac2c75aef4edddf3236f15d4d08ac
SHA512 ecde28b9cb210cd5f4a4296737ffa5e5f871c38cf60b57cd995c6b9b0dc2b6bccbbb40e4d45003e4c5139c67cfe3d37f21a3cfe1e8f84831be7480f31f620f69

memory/2956-192-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2956-191-0x0000000000900000-0x00000000019BA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-04 04:52

Reported

2024-11-04 04:55

Platform

win10v2004-20241007-en

Max time kernel

123s

Max time network

128s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e5786f3 C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e5787ae.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57b15e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1184 wrote to memory of 1888 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1184 wrote to memory of 1888 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1184 wrote to memory of 1888 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1888 wrote to memory of 4784 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e578618.exe
PID 1888 wrote to memory of 4784 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e578618.exe
PID 1888 wrote to memory of 4784 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e578618.exe
PID 4784 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\fontdrvhost.exe
PID 4784 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\fontdrvhost.exe
PID 4784 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\dwm.exe
PID 4784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\sihost.exe
PID 4784 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\svchost.exe
PID 4784 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\taskhostw.exe
PID 4784 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\Explorer.EXE
PID 4784 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\svchost.exe
PID 4784 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\DllHost.exe
PID 4784 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4784 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\System32\RuntimeBroker.exe
PID 4784 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4784 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\System32\RuntimeBroker.exe
PID 4784 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4784 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\System32\RuntimeBroker.exe
PID 4784 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4784 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4784 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\rundll32.exe
PID 4784 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SysWOW64\rundll32.exe
PID 4784 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SysWOW64\rundll32.exe
PID 1888 wrote to memory of 1332 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5787ae.exe
PID 1888 wrote to memory of 1332 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5787ae.exe
PID 1888 wrote to memory of 1332 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5787ae.exe
PID 4784 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\fontdrvhost.exe
PID 4784 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\fontdrvhost.exe
PID 4784 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\dwm.exe
PID 4784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\sihost.exe
PID 4784 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\svchost.exe
PID 4784 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\taskhostw.exe
PID 4784 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\Explorer.EXE
PID 4784 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\svchost.exe
PID 4784 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\DllHost.exe
PID 4784 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4784 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\System32\RuntimeBroker.exe
PID 4784 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4784 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\System32\RuntimeBroker.exe
PID 4784 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4784 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\System32\RuntimeBroker.exe
PID 4784 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4784 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4784 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\rundll32.exe
PID 4784 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Users\Admin\AppData\Local\Temp\e5787ae.exe
PID 4784 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Users\Admin\AppData\Local\Temp\e5787ae.exe
PID 4784 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\system32\BackgroundTaskHost.exe
PID 4784 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\e578618.exe C:\Windows\System32\RuntimeBroker.exe
PID 1888 wrote to memory of 4760 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe
PID 1888 wrote to memory of 4760 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe
PID 1888 wrote to memory of 4760 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e578618.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#1

C:\Users\Admin\AppData\Local\Temp\e578618.exe

C:\Users\Admin\AppData\Local\Temp\e578618.exe

C:\Users\Admin\AppData\Local\Temp\e5787ae.exe

C:\Users\Admin\AppData\Local\Temp\e5787ae.exe

C:\Windows\system32\BackgroundTaskHost.exe

"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\e57b15e.exe

C:\Users\Admin\AppData\Local\Temp\e57b15e.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/1888-0-0x0000000010000000-0x0000000010020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e578618.exe

MD5 3f4855e34ca66d4a8d94da47ea4b3cbc
SHA1 0ff399f134c2bd145b036be821422c2103d5edb0
SHA256 57aaf3e40638ea3b12e7c2b5626d777125d2a484ddefec767271132195842fb0
SHA512 42e89070a4dcdaae7368b3543a3bf5a7750872ac3405f66478def13d3a33db9799fee767c312fa1e13190ee9caee8db194e551631900bb868e04f6d6244a7be3

memory/4784-4-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4784-6-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1888-15-0x0000000001630000-0x0000000001632000-memory.dmp

memory/1332-23-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1888-26-0x0000000001630000-0x0000000001632000-memory.dmp

memory/4784-9-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-18-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-10-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-19-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4784-24-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-22-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4784-27-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-8-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-14-0x0000000000740000-0x0000000000741000-memory.dmp

memory/4784-32-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1888-12-0x00000000045A0000-0x00000000045A1000-memory.dmp

memory/4784-33-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1888-11-0x0000000001630000-0x0000000001632000-memory.dmp

memory/4784-34-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-35-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-36-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-37-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-39-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1332-42-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1332-41-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/1332-43-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4784-38-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1888-48-0x0000000001630000-0x0000000001632000-memory.dmp

memory/4760-51-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4784-53-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-54-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4784-55-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-56-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-58-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-59-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-61-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-63-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4784-68-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1332-87-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4784-88-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4760-89-0x0000000000400000-0x0000000000412000-memory.dmp