Malware Analysis Report

2025-04-13 23:58

Sample ID 241104-rqhd9s1crh
Target 630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384dfN
SHA256 630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384df
Tags
sality backdoor discovery evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384df

Threat Level: Known bad

The file 630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384dfN was found to be: Known bad.

Malicious Activity Summary

sality backdoor discovery evasion trojan upx

Sality

Windows security bypass

Modifies firewall policy service

UAC bypass

Sality family

Loads dropped DLL

Executes dropped EXE

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

UPX packed file

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-04 14:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-04 14:23

Reported

2024-11-04 14:27

Platform

win7-20240903-en

Max time kernel

28s

Max time network

19s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f774e4f C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
File created C:\Windows\f76fc88 C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2648 wrote to memory of 2272 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2648 wrote to memory of 2272 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2648 wrote to memory of 2272 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2648 wrote to memory of 2272 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2648 wrote to memory of 2272 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2648 wrote to memory of 2272 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2648 wrote to memory of 2272 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 2700 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe
PID 2272 wrote to memory of 2700 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe
PID 2272 wrote to memory of 2700 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe
PID 2272 wrote to memory of 2700 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe
PID 2700 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\system32\taskhost.exe
PID 2700 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\system32\Dwm.exe
PID 2700 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\Explorer.EXE
PID 2700 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\system32\DllHost.exe
PID 2700 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\system32\rundll32.exe
PID 2700 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\SysWOW64\rundll32.exe
PID 2700 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 3064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fed8.exe
PID 2272 wrote to memory of 3064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fed8.exe
PID 2272 wrote to memory of 3064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fed8.exe
PID 2272 wrote to memory of 3064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76fed8.exe
PID 2272 wrote to memory of 2964 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771610.exe
PID 2272 wrote to memory of 2964 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771610.exe
PID 2272 wrote to memory of 2964 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771610.exe
PID 2272 wrote to memory of 2964 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771610.exe
PID 2700 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\system32\taskhost.exe
PID 2700 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\system32\Dwm.exe
PID 2700 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\Explorer.EXE
PID 2700 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Windows\system32\DllHost.exe
PID 2700 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Users\Admin\AppData\Local\Temp\f76fed8.exe
PID 2700 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Users\Admin\AppData\Local\Temp\f76fed8.exe
PID 2700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Users\Admin\AppData\Local\Temp\f771610.exe
PID 2700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe C:\Users\Admin\AppData\Local\Temp\f771610.exe
PID 2964 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe C:\Windows\system32\taskhost.exe
PID 2964 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe C:\Windows\system32\Dwm.exe
PID 2964 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe C:\Windows\Explorer.EXE
PID 2964 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\f771610.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f771610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384dfN.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384dfN.dll,#1

C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe

C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe

C:\Users\Admin\AppData\Local\Temp\f76fed8.exe

C:\Users\Admin\AppData\Local\Temp\f76fed8.exe

C:\Users\Admin\AppData\Local\Temp\f771610.exe

C:\Users\Admin\AppData\Local\Temp\f771610.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\f76fb9e.exe

MD5 1166d45e99dc0fb5ffcacf4764c45cae
SHA1 6c0ecd73a25210ef3f86cd5afbb2f46a32a12fe9
SHA256 a2ba7b3676c31f32b1ba058b1f0a6a5d04d81ec472ae12733796b59917ba6fb1
SHA512 27d62372758d7c3165be842f45bbb93cc231f5336b786aca3c05a782d03e2188bac7247ef02a574a584e5bc2fdaf6f0fac57a4b6bf53b7d85cadb7405b8ca9f1

memory/2272-14-0x0000000000240000-0x0000000000252000-memory.dmp

memory/2700-13-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2272-7-0x0000000000240000-0x0000000000252000-memory.dmp

memory/2272-2-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2272-0-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2272-3-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2272-1-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2700-22-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-19-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-17-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-18-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/3064-64-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2272-62-0x0000000000820000-0x0000000000822000-memory.dmp

memory/2700-21-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-52-0x0000000000390000-0x0000000000392000-memory.dmp

memory/2700-25-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-50-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/2700-24-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2272-44-0x0000000000830000-0x0000000000831000-memory.dmp

memory/2700-23-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-20-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2272-34-0x0000000000820000-0x0000000000822000-memory.dmp

memory/1108-27-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2700-26-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2272-61-0x0000000000890000-0x00000000008A2000-memory.dmp

memory/2700-60-0x0000000000390000-0x0000000000392000-memory.dmp

memory/2272-59-0x0000000000820000-0x0000000000822000-memory.dmp

memory/2272-35-0x0000000000830000-0x0000000000831000-memory.dmp

memory/2964-76-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2272-72-0x0000000000820000-0x0000000000822000-memory.dmp

memory/2700-78-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-79-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/3064-97-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2964-96-0x0000000000360000-0x0000000000362000-memory.dmp

memory/3064-95-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2964-94-0x0000000000360000-0x0000000000362000-memory.dmp

memory/2964-93-0x0000000000370000-0x0000000000371000-memory.dmp

memory/3064-89-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2700-77-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-99-0x0000000000390000-0x0000000000392000-memory.dmp

memory/2700-98-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-100-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-101-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-103-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-104-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/2700-105-0x0000000000640000-0x00000000016FA000-memory.dmp

memory/3064-107-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2700-126-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2700-127-0x0000000000640000-0x00000000016FA000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 aafc38be04b0ba90ea48f29c00f0ec04
SHA1 f8bdfd3e4637f0d7f20f25017e3ed0f8f260da4f
SHA256 a47c36fd29bf0f67463bd79a08705ff93415043fafc33bf488aecb8201e1cc62
SHA512 fbd2764580ccdbf40c959e62767bc9002d1f88c207eb7bb476af5e851a31999806b069cef0a1b1b481b369a9879d92d1f1473e0ef4beae10683830f35405abf4

memory/2964-134-0x0000000000930000-0x00000000019EA000-memory.dmp

memory/2964-178-0x0000000000930000-0x00000000019EA000-memory.dmp

memory/2964-177-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3064-182-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-04 14:23

Reported

2024-11-04 14:27

Platform

win10v2004-20241007-en

Max time kernel

104s

Max time network

111s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e57b083 C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57b15e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3440 wrote to memory of 4520 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3440 wrote to memory of 4520 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3440 wrote to memory of 4520 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4520 wrote to memory of 4284 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57a921.exe
PID 4520 wrote to memory of 4284 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57a921.exe
PID 4520 wrote to memory of 4284 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57a921.exe
PID 4284 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\fontdrvhost.exe
PID 4284 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\fontdrvhost.exe
PID 4284 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\dwm.exe
PID 4284 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\sihost.exe
PID 4284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\svchost.exe
PID 4284 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\taskhostw.exe
PID 4284 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\Explorer.EXE
PID 4284 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\svchost.exe
PID 4284 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\DllHost.exe
PID 4284 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4284 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4284 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4284 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4284 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4284 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\rundll32.exe
PID 4284 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SysWOW64\rundll32.exe
PID 4284 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SysWOW64\rundll32.exe
PID 4520 wrote to memory of 4800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe
PID 4520 wrote to memory of 4800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe
PID 4520 wrote to memory of 4800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe
PID 4520 wrote to memory of 1192 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe
PID 4520 wrote to memory of 1192 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe
PID 4520 wrote to memory of 1192 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe
PID 4284 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\fontdrvhost.exe
PID 4284 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\fontdrvhost.exe
PID 4284 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\dwm.exe
PID 4284 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\sihost.exe
PID 4284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\svchost.exe
PID 4284 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\taskhostw.exe
PID 4284 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\Explorer.EXE
PID 4284 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\svchost.exe
PID 4284 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\DllHost.exe
PID 4284 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4284 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4284 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4284 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\System32\RuntimeBroker.exe
PID 4284 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4284 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4284 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe
PID 4284 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Users\Admin\AppData\Local\Temp\e57b15e.exe
PID 4284 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe
PID 4284 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\e57a921.exe C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57a921.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384dfN.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\630030987c99d569d87b1f3046da91c923d52daf5bd48395f48775ebfbc384dfN.dll,#1

C:\Users\Admin\AppData\Local\Temp\e57a921.exe

C:\Users\Admin\AppData\Local\Temp\e57a921.exe

C:\Users\Admin\AppData\Local\Temp\e57b15e.exe

C:\Users\Admin\AppData\Local\Temp\e57b15e.exe

C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe

C:\Users\Admin\AppData\Local\Temp\e57cb8d.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4520-0-0x0000000010000000-0x0000000010020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e57a921.exe

MD5 1166d45e99dc0fb5ffcacf4764c45cae
SHA1 6c0ecd73a25210ef3f86cd5afbb2f46a32a12fe9
SHA256 a2ba7b3676c31f32b1ba058b1f0a6a5d04d81ec472ae12733796b59917ba6fb1
SHA512 27d62372758d7c3165be842f45bbb93cc231f5336b786aca3c05a782d03e2188bac7247ef02a574a584e5bc2fdaf6f0fac57a4b6bf53b7d85cadb7405b8ca9f1

memory/4284-5-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4284-6-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-15-0x0000000003D30000-0x0000000003D31000-memory.dmp

memory/4284-25-0x0000000003520000-0x0000000003522000-memory.dmp

memory/4800-30-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4284-10-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-11-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-24-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-32-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-31-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-27-0x0000000003520000-0x0000000003522000-memory.dmp

memory/4520-26-0x00000000010F0000-0x00000000010F2000-memory.dmp

memory/4284-9-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-8-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-36-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-34-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-33-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-35-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4520-13-0x0000000001100000-0x0000000001101000-memory.dmp

memory/4520-12-0x00000000010F0000-0x00000000010F2000-memory.dmp

memory/4520-16-0x00000000010F0000-0x00000000010F2000-memory.dmp

memory/4284-37-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-38-0x0000000000790000-0x000000000184A000-memory.dmp

memory/1192-47-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4284-39-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-50-0x0000000000790000-0x000000000184A000-memory.dmp

memory/1192-59-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4284-64-0x0000000003520000-0x0000000003522000-memory.dmp

memory/1192-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4800-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1192-61-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4800-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4800-57-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4284-66-0x0000000000790000-0x000000000184A000-memory.dmp

memory/4284-85-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4800-86-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4800-89-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1192-93-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1192-90-0x00000000001E0000-0x00000000001E2000-memory.dmp