Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 02:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
procesosCUI7254178000020150023000.exe
Resource
win7-20241010-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
procesosCUI7254178000020150023000.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
29 signatures
150 seconds
General
-
Target
procesosCUI7254178000020150023000.exe
-
Size
908KB
-
MD5
e93703d8357807ba8be42ce5bd71d99b
-
SHA1
f557b727748f4aa01265b2bc8e46b6201b5f3b7c
-
SHA256
fa083a970c90e1e17f4aa83ccd7f0bf52b5e0f35eaf4eeda73abdc115d9b55b9
-
SHA512
b8ad5c57586b70a769d1f9562148de63a3c5835d6a35d3302f33d4d20619254ae5ae6a1703fb26aaa574d96ba15b053359fe0b17059577256a86ebeb53a9b5af
-
SSDEEP
24576:Fg/fK9XbMAWE9XEhG7q9efZyHS7en+gIlh:q4Mj4088HS7e+gIlh
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3348-11-0x0000000000400000-0x000000000045C000-memory.dmp disable_win_def -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Vespre.exe -
Modifies security service 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" Vespre.exe -
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/3348-11-0x0000000000400000-0x000000000045C000-memory.dmp family_quasar -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Vespre.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" Vespre.exe -
Executes dropped EXE 2 IoCs
pid Process 4372 Vespre.exe 1148 Vespre.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" Vespre.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" procesosCUI7254178000020150023000.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\procesosCUI7254178000020150023000.exe\"" procesosCUI7254178000020150023000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\"" Vespre.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\"" Vespre.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\procesosCUI7254178000020150023000.exe\"" procesosCUI7254178000020150023000.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" procesosCUI7254178000020150023000.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Vespre.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 19 pastebin.com 20 pastebin.com 44 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ip-api.com -
Modifies Security services 2 TTPs 16 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdBoot\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdFilter\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdBoot\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisDrv\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisSvc\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisSvc\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdFilter\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" Vespre.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisDrv\Start = "4" Vespre.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 512 set thread context of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 4372 set thread context of 1148 4372 Vespre.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procesosCUI7254178000020150023000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vespre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procesosCUI7254178000020150023000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vespre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1548 schtasks.exe 8 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4540 powershell.exe 4540 powershell.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 2508 powershell.exe 2508 powershell.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4020 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3348 procesosCUI7254178000020150023000.exe Token: SeDebugPrivilege 4540 powershell.exe Token: SeDebugPrivilege 4020 taskmgr.exe Token: SeSystemProfilePrivilege 4020 taskmgr.exe Token: SeCreateGlobalPrivilege 4020 taskmgr.exe Token: SeDebugPrivilege 1148 Vespre.exe Token: SeDebugPrivilege 2508 powershell.exe Token: SeSecurityPrivilege 4020 taskmgr.exe Token: SeTakeOwnershipPrivilege 4020 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1148 Vespre.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 512 wrote to memory of 3348 512 procesosCUI7254178000020150023000.exe 92 PID 3348 wrote to memory of 1548 3348 procesosCUI7254178000020150023000.exe 93 PID 3348 wrote to memory of 1548 3348 procesosCUI7254178000020150023000.exe 93 PID 3348 wrote to memory of 1548 3348 procesosCUI7254178000020150023000.exe 93 PID 3348 wrote to memory of 5068 3348 procesosCUI7254178000020150023000.exe 95 PID 3348 wrote to memory of 5068 3348 procesosCUI7254178000020150023000.exe 95 PID 3348 wrote to memory of 5068 3348 procesosCUI7254178000020150023000.exe 95 PID 3348 wrote to memory of 4540 3348 procesosCUI7254178000020150023000.exe 97 PID 3348 wrote to memory of 4540 3348 procesosCUI7254178000020150023000.exe 97 PID 3348 wrote to memory of 4540 3348 procesosCUI7254178000020150023000.exe 97 PID 3348 wrote to memory of 4372 3348 procesosCUI7254178000020150023000.exe 99 PID 3348 wrote to memory of 4372 3348 procesosCUI7254178000020150023000.exe 99 PID 3348 wrote to memory of 4372 3348 procesosCUI7254178000020150023000.exe 99 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 4372 wrote to memory of 1148 4372 Vespre.exe 104 PID 1148 wrote to memory of 8 1148 Vespre.exe 105 PID 1148 wrote to memory of 8 1148 Vespre.exe 105 PID 1148 wrote to memory of 8 1148 Vespre.exe 105 PID 1148 wrote to memory of 960 1148 Vespre.exe 107 PID 1148 wrote to memory of 960 1148 Vespre.exe 107 PID 1148 wrote to memory of 960 1148 Vespre.exe 107 PID 1148 wrote to memory of 2508 1148 Vespre.exe 109 PID 1148 wrote to memory of 2508 1148 Vespre.exe 109 PID 1148 wrote to memory of 2508 1148 Vespre.exe 109 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" procesosCUI7254178000020150023000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Vespre.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Vespre.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\procesosCUI7254178000020150023000.exe"C:\Users\Admin\AppData\Local\Temp\procesosCUI7254178000020150023000.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\procesosCUI7254178000020150023000.exe"C:\Users\Admin\AppData\Local\Temp\procesosCUI7254178000020150023000.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Security services
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3348 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\procesosCUI7254178000020150023000.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1548
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /delete /tn "iceTelemetryLogtte" /f3⤵
- System Location Discovery: System Language Discovery
PID:5068
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Security services
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1148 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe" /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:8
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /delete /tn "iceTelemetryLogtte" /f5⤵
- System Location Discovery: System Language Discovery
PID:960
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4020
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5008
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
4Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\procesosCUI7254178000020150023000.exe.log
Filesize1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
18KB
MD5115adbca0fcdb70b054e0f37ea04afad
SHA1c6d42a5c8e3087ed1c6c61d354ec318b75bb4cee
SHA256fd3583cf198109974552ad22a4cd693f2bbe99a56128b927a0934bc09d7679d3
SHA512de20e25514228a4bde73590279e568ad0f72bb30a560518a30a0d19d59144dab7bfa3f4aa1644bb55b48813d2f729e6884c7a7c8b76e5e333d5c42e8e2dbbf9d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
908KB
MD5e93703d8357807ba8be42ce5bd71d99b
SHA1f557b727748f4aa01265b2bc8e46b6201b5f3b7c
SHA256fa083a970c90e1e17f4aa83ccd7f0bf52b5e0f35eaf4eeda73abdc115d9b55b9
SHA512b8ad5c57586b70a769d1f9562148de63a3c5835d6a35d3302f33d4d20619254ae5ae6a1703fb26aaa574d96ba15b053359fe0b17059577256a86ebeb53a9b5af
-
Filesize
137B
MD5e300bfd7654b37a40e3cdfcfc133925d
SHA18d6c642420b210bcd2b0ce56f0a6120253b2f48c
SHA2569e454fe5db90a66baab1bb00fce530ce8ade3990b3bd9c18ba354c3223ed3e7a
SHA51229343529bd003bbb35416b3df521d1b1ba604334981c6e8fca52390e71dd985fa4125f9ea8a63242710f792982d7b27b6f98a0cb009a065943a0e657df2f8483