Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
07/11/2024, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
120 seconds
General
- Target 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe
- Size 1.2MB
- Sample241107-ejjmjaxmel
- SHA256 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4
- MD5 f22a3592751ffcde9933caae5e98b0e0
- SHA1 d77b2f0ee679b17033ad7f4532f7f094a5703a42
- SHA512 92d2f48976db63aa9ea72489f421bc52be0b1de348f9d40d18bac83c159d689873a974f5824f02459633a6041351f566d9c6bdef6c1c514934061afd12aa2b85
- SSDEEP 24576:r/QU+XFJWKkkkkkkI5YvasDJTtpz7C8Gye3We8o4vNYof58mi:rEXFJW3Yiylth7JQ/WviV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe - Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe - Executes dropped EXE 1 IoCs
pid Process 3024 inst.exe - Loads dropped DLL 4 IoCs
pid Process 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 3024 inst.exe 3024 inst.exe 3024 inst.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe - Enumerates connected drives 3 TTPs 43 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: inst.exe File opened (read-only) \??\M: inst.exe File opened (read-only) \??\R: inst.exe File opened (read-only) \??\W: inst.exe File opened (read-only) \??\Z: inst.exe File opened (read-only) \??\H: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\J: inst.exe File opened (read-only) \??\Y: inst.exe File opened (read-only) \??\I: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\L: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\M: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\E: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\G: inst.exe File opened (read-only) \??\I: inst.exe File opened (read-only) \??\V: inst.exe File opened (read-only) \??\V: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\Y: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\N: inst.exe File opened (read-only) \??\X: inst.exe File opened (read-only) \??\P: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\S: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\A: inst.exe File opened (read-only) \??\E: inst.exe File opened (read-only) \??\Q: inst.exe File opened (read-only) \??\W: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\G: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\B: inst.exe File opened (read-only) \??\H: inst.exe File opened (read-only) \??\O: inst.exe File opened (read-only) \??\T: inst.exe File opened (read-only) \??\J: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\N: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\O: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\R: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\K: inst.exe File opened (read-only) \??\S: inst.exe File opened (read-only) \??\U: inst.exe File opened (read-only) \??\K: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\P: inst.exe File opened (read-only) \??\Q: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\T: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\U: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened (read-only) \??\X: 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe -
resource yara_rule behavioral1/memory/2644-1-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-7-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-10-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-11-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-12-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-8-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-6-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-5-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-9-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-4-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-35-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-34-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-36-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-37-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-38-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-40-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-41-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-43-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-42-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-81-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-82-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-108-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-109-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral1/memory/2644-187-0x0000000002900000-0x00000000039BA000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76fa18 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe File opened for modification C:\Windows\SYSTEM.INI 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inst.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe - Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeShutdownPrivilege 3024 inst.exe Token: SeIncreaseQuotaPrivilege 3024 inst.exe Token: SeRestorePrivilege 1664 msiexec.exe Token: SeTakeOwnershipPrivilege 1664 msiexec.exe Token: SeSecurityPrivilege 1664 msiexec.exe Token: SeCreateTokenPrivilege 3024 inst.exe Token: SeAssignPrimaryTokenPrivilege 3024 inst.exe Token: SeLockMemoryPrivilege 3024 inst.exe Token: SeIncreaseQuotaPrivilege 3024 inst.exe Token: SeMachineAccountPrivilege 3024 inst.exe Token: SeTcbPrivilege 3024 inst.exe Token: SeSecurityPrivilege 3024 inst.exe Token: SeTakeOwnershipPrivilege 3024 inst.exe Token: SeLoadDriverPrivilege 3024 inst.exe Token: SeSystemProfilePrivilege 3024 inst.exe Token: SeSystemtimePrivilege 3024 inst.exe Token: SeProfSingleProcessPrivilege 3024 inst.exe Token: SeIncBasePriorityPrivilege 3024 inst.exe Token: SeCreatePagefilePrivilege 3024 inst.exe Token: SeCreatePermanentPrivilege 3024 inst.exe Token: SeBackupPrivilege 3024 inst.exe Token: SeRestorePrivilege 3024 inst.exe Token: SeShutdownPrivilege 3024 inst.exe Token: SeDebugPrivilege 3024 inst.exe Token: SeAuditPrivilege 3024 inst.exe Token: SeSystemEnvironmentPrivilege 3024 inst.exe Token: SeChangeNotifyPrivilege 3024 inst.exe Token: SeRemoteShutdownPrivilege 3024 inst.exe Token: SeUndockPrivilege 3024 inst.exe Token: SeSyncAgentPrivilege 3024 inst.exe Token: SeEnableDelegationPrivilege 3024 inst.exe Token: SeManageVolumePrivilege 3024 inst.exe Token: SeImpersonatePrivilege 3024 inst.exe Token: SeCreateGlobalPrivilege 3024 inst.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe Token: SeDebugPrivilege 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3024 inst.exe 3024 inst.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1104 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 19 PID 2644 wrote to memory of 1172 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 20 PID 2644 wrote to memory of 1208 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 21 PID 2644 wrote to memory of 1532 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 23 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 1104 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 19 PID 2644 wrote to memory of 1172 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 20 PID 2644 wrote to memory of 1208 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 21 PID 2644 wrote to memory of 1532 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 23 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 3024 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 30 PID 2644 wrote to memory of 1104 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 19 PID 2644 wrote to memory of 1172 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 20 PID 2644 wrote to memory of 1208 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 21 PID 2644 wrote to memory of 1532 2644 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe 23 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe"C:\Users\Admin\AppData\Local\Temp\52fa843d5d09924fb240052144e6828263b9a4bf11eb3d2037405d2db8972bd4N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\inst.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\inst.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3024
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1532
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\langpack.msi
- Size 370KB
- SHA256 c39a57c405e9bb68c64872870f074f60efdd1ce5d6f974eaf3270f9935eeecb8
- MD5 f35b37767135aa20352920727e3b36ed
- SHA1 05edca624ecfb64bfe0e4ef4b55075f6dedbdf7a
- SHA512 77ad2c7168f1563110c22fef57e42f06bbb6dba61b5124942619af23359a58ffe2f49b08781277c2f9f93e196ecb503217c1c5ea8b09b22fbde7aa6ed0f80280
- SSDEEP 6144:q64/bYWEvGkkkkkkaNkHUZ5vE8afcC4mzDJ/QxJ/:q1zYWlkkkkkkaNkHUZ5naEaJIF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.ini
- Size 141B
- SHA256 04664f1a6c63a6e558be6c6894d06a44732268739407c9b96e3f4199a50ee79a
- MD5 adfa7c0ec02f1f6bb34116b3adcbc5c1
- SHA1 e2e2c02d6fe7abb2b30476cc8c6de466906c8044
- SHA512 52a502975d049a5d81d7e412b78d995f58606c06abd51c376bcee5528b488aa26b31b545a453749e33d74ba0746973c509da9cc56b10297a7bc6039e2ead3a2c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\langpackSetup.log
- Size 266B
- SHA256 c888a7c9392024b22fd6861aaf09fe61483c65d947d1b39e16b22fc5f7b393bc
- MD5 1e4d8caf142f22af790e444153a3cd6c
- SHA1 a4f65c1fee4abc8dcf991413154622cc66ff4329
- SHA512 6f5cbd9a7a9fa79b70f995c4985622e5e8c2261457868a8dde5fd00c44d02adae071c7aa32167eaf49ab580f2257d70b6f7797b7b432cc0a5454601d3ea11ded
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\langpackSetup.log
- Size 853B
- SHA256 41caf6ee11d8db12304d75a9e0fce76304914e3a1a516c56eff65054a655f75f
- MD5 138af19289c684765c530c5add2801ba
- SHA1 0f93436d25c6bd5288dfef61bc176cd886d4c782
- SHA512 eadece9dee0b27f735a8804ba386888841cfab5120cc88f1813d6e7544b787ff31b5a778d1b6654326eeb2d18010343e18ec06c4b241612e4ec3a25b800140c0
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\inst.exe
- Size 68KB
- SHA256 df1c994683054f8270821fdcc7ebca1c46ec136445e67e85660536c7b3f623a8
- MD5 02c838b356389aa3ffdcb055a83f38b8
- SHA1 b3d050d8299cea9e1e4dad89f115c0b9cf712d73
- SHA512 52147d03a8539716856063c20db891a4ceb7a6f605d433a8144c2cf9396a7d610899f864216674a417e5777715749496560304bacda387c86e5b1e0e1e3e31ee
- SSDEEP 1536:r6WyHRGhriIQ14En45Q0npZ/Ic5eh8PdKfAHfw0BoD:r6WyHRGhriIQO5Q0LIV8n40BoD
- MD5 SHA1 SHA512 SSDEEP