Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll
Resource
win7-20240903-en
General
-
Target
3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll
-
Size
120KB
-
MD5
817e9dacb5b8773238380f76e4348180
-
SHA1
bb8a2ebe6d1b0f3b4eea17fc3f7aee6705af727d
-
SHA256
3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728a
-
SHA512
edde71ba00211057e7a614e3fe8a24aef8bd3e185306329dff1015b491c8ecda5d25a18802e36449a491df516c2f08524f246d8837864b5140abd5e6c8479c35
-
SSDEEP
1536:xZoPPJtIPlmNZ2VfcLBMHRRbnoBaZEoaUQH4oZ3x3Ej5A0m7Mb3fVT1B:GhttNZ2CLa/bnoQioaUP+44Wt1B
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57cff2.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b46b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b46b.exe -
Executes dropped EXE 3 IoCs
pid Process 4868 e57b46b.exe 2160 e57b67f.exe 412 e57cff2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cff2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cff2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57cff2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b46b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cff2.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: e57b46b.exe File opened (read-only) \??\G: e57b46b.exe File opened (read-only) \??\K: e57b46b.exe File opened (read-only) \??\L: e57b46b.exe File opened (read-only) \??\O: e57b46b.exe File opened (read-only) \??\E: e57cff2.exe File opened (read-only) \??\H: e57b46b.exe File opened (read-only) \??\I: e57b46b.exe File opened (read-only) \??\P: e57b46b.exe File opened (read-only) \??\Q: e57b46b.exe File opened (read-only) \??\E: e57b46b.exe File opened (read-only) \??\J: e57b46b.exe File opened (read-only) \??\M: e57b46b.exe File opened (read-only) \??\N: e57b46b.exe File opened (read-only) \??\S: e57b46b.exe -
resource yara_rule behavioral2/memory/4868-6-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-10-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-18-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-11-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-13-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-29-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-33-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-19-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-25-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-9-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-8-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-36-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-37-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-38-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-40-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-39-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-42-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-43-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-52-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-54-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-56-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-58-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-68-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-71-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-73-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-75-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-77-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-78-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-80-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-82-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-81-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4868-88-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/412-126-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/412-151-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57b46b.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57b46b.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57b46b.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57b46b.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57b4c9 e57b46b.exe File opened for modification C:\Windows\SYSTEM.INI e57b46b.exe File created C:\Windows\e580606 e57cff2.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b46b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b67f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cff2.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4868 e57b46b.exe 4868 e57b46b.exe 4868 e57b46b.exe 4868 e57b46b.exe 412 e57cff2.exe 412 e57cff2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe Token: SeDebugPrivilege 4868 e57b46b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1360 wrote to memory of 1144 1360 rundll32.exe 83 PID 1360 wrote to memory of 1144 1360 rundll32.exe 83 PID 1360 wrote to memory of 1144 1360 rundll32.exe 83 PID 1144 wrote to memory of 4868 1144 rundll32.exe 84 PID 1144 wrote to memory of 4868 1144 rundll32.exe 84 PID 1144 wrote to memory of 4868 1144 rundll32.exe 84 PID 4868 wrote to memory of 772 4868 e57b46b.exe 8 PID 4868 wrote to memory of 780 4868 e57b46b.exe 9 PID 4868 wrote to memory of 64 4868 e57b46b.exe 13 PID 4868 wrote to memory of 2820 4868 e57b46b.exe 50 PID 4868 wrote to memory of 2928 4868 e57b46b.exe 51 PID 4868 wrote to memory of 3052 4868 e57b46b.exe 52 PID 4868 wrote to memory of 3528 4868 e57b46b.exe 56 PID 4868 wrote to memory of 3652 4868 e57b46b.exe 57 PID 4868 wrote to memory of 3836 4868 e57b46b.exe 58 PID 4868 wrote to memory of 3928 4868 e57b46b.exe 59 PID 4868 wrote to memory of 3996 4868 e57b46b.exe 60 PID 4868 wrote to memory of 4084 4868 e57b46b.exe 61 PID 4868 wrote to memory of 3960 4868 e57b46b.exe 62 PID 4868 wrote to memory of 3768 4868 e57b46b.exe 75 PID 4868 wrote to memory of 2488 4868 e57b46b.exe 76 PID 4868 wrote to memory of 2316 4868 e57b46b.exe 80 PID 4868 wrote to memory of 1360 4868 e57b46b.exe 82 PID 4868 wrote to memory of 1144 4868 e57b46b.exe 83 PID 4868 wrote to memory of 1144 4868 e57b46b.exe 83 PID 1144 wrote to memory of 2160 1144 rundll32.exe 85 PID 1144 wrote to memory of 2160 1144 rundll32.exe 85 PID 1144 wrote to memory of 2160 1144 rundll32.exe 85 PID 1144 wrote to memory of 412 1144 rundll32.exe 95 PID 1144 wrote to memory of 412 1144 rundll32.exe 95 PID 1144 wrote to memory of 412 1144 rundll32.exe 95 PID 4868 wrote to memory of 772 4868 e57b46b.exe 8 PID 4868 wrote to memory of 780 4868 e57b46b.exe 9 PID 4868 wrote to memory of 64 4868 e57b46b.exe 13 PID 4868 wrote to memory of 2820 4868 e57b46b.exe 50 PID 4868 wrote to memory of 2928 4868 e57b46b.exe 51 PID 4868 wrote to memory of 3052 4868 e57b46b.exe 52 PID 4868 wrote to memory of 3528 4868 e57b46b.exe 56 PID 4868 wrote to memory of 3652 4868 e57b46b.exe 57 PID 4868 wrote to memory of 3836 4868 e57b46b.exe 58 PID 4868 wrote to memory of 3928 4868 e57b46b.exe 59 PID 4868 wrote to memory of 3996 4868 e57b46b.exe 60 PID 4868 wrote to memory of 4084 4868 e57b46b.exe 61 PID 4868 wrote to memory of 3960 4868 e57b46b.exe 62 PID 4868 wrote to memory of 3768 4868 e57b46b.exe 75 PID 4868 wrote to memory of 2488 4868 e57b46b.exe 76 PID 4868 wrote to memory of 2160 4868 e57b46b.exe 85 PID 4868 wrote to memory of 2160 4868 e57b46b.exe 85 PID 4868 wrote to memory of 2580 4868 e57b46b.exe 87 PID 4868 wrote to memory of 2436 4868 e57b46b.exe 88 PID 4868 wrote to memory of 412 4868 e57b46b.exe 95 PID 4868 wrote to memory of 412 4868 e57b46b.exe 95 PID 412 wrote to memory of 772 412 e57cff2.exe 8 PID 412 wrote to memory of 780 412 e57cff2.exe 9 PID 412 wrote to memory of 64 412 e57cff2.exe 13 PID 412 wrote to memory of 2820 412 e57cff2.exe 50 PID 412 wrote to memory of 2928 412 e57cff2.exe 51 PID 412 wrote to memory of 3052 412 e57cff2.exe 52 PID 412 wrote to memory of 3528 412 e57cff2.exe 56 PID 412 wrote to memory of 3652 412 e57cff2.exe 57 PID 412 wrote to memory of 3836 412 e57cff2.exe 58 PID 412 wrote to memory of 3928 412 e57cff2.exe 59 PID 412 wrote to memory of 3996 412 e57cff2.exe 60 PID 412 wrote to memory of 4084 412 e57cff2.exe 61 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b46b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cff2.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2928
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3052
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\e57b46b.exeC:\Users\Admin\AppData\Local\Temp\e57b46b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4868
-
-
C:\Users\Admin\AppData\Local\Temp\e57b67f.exeC:\Users\Admin\AppData\Local\Temp\e57b67f.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\e57cff2.exeC:\Users\Admin\AppData\Local\Temp\e57cff2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:412
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3652
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3996
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4084
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3960
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3768
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2488
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2316
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2580
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2436
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD51533ebac136efa69caa3cc580643f172
SHA1a031ed4833fa6f7a9442df63688c4c932fbbef4c
SHA256b6bef51c4b617dfc72802416539bfa58f25a8650fd665f0932d11f77ab88463f
SHA512e4b8521396b6d466480dbf255daa9bc0749c7acb48f9c67838fb4b2e4c4a3070d15daebbdf9538f7e4e1659e3de904d0612205214a9b5a22285beb4a73d9e8de
-
Filesize
257B
MD5c3049441e502ee1c747d9f978145edec
SHA1b49e6c159e2b7a9c0dbbdc2dfdb6015735b55eda
SHA256b01c4b04753c7030c61273e3498b66c0a6e656b57ad12cc4753c4a578a8b1568
SHA5122d2bb017a85a842bcfc275e90531d166eefcaa41565b17bd257cdf3cb9e59928ca9847db5f4ae514bfb5c5f9b95de45372dd98e437c004b26d21e74ac31c3148