Analysis
- max time kernel
93s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2024, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
General
- Target 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe
- Size 65KB
- Sample241108-a3d4ya1fqf
- SHA256 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096
- MD5 273363f829a67e8145de9c16fc2e75a2
- SHA1 bf5eb8fa74b2e4d1ae0ebd66b2861ecced43408f
- SHA512 0ec6a56d47a3f61ddc40221f27b7d742b87850c5fdc1e8289a0d363801134bcef3c8454767c77b81e4704fcea25a5711ec7d325ce8f89a9ac419d2b781b5d4dc
- SSDEEP 1536:R+s/iFtbxcoQ79z1ADo1ysphrli//AP38KpwkNcCLsI9SF4N3:wwCxrQ7kDossphh64kKprNP5q4h
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe - Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe - Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe File opened (read-only) \??\H: 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe File opened (read-only) \??\I: 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe File opened (read-only) \??\J: 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe File opened (read-only) \??\K: 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe File opened (read-only) \??\L: 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe File opened (read-only) \??\E: 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe -
resource yara_rule behavioral2/memory/2836-7-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-1-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-5-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-6-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-17-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-19-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-14-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-9-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-3-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-4-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-21-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-23-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-22-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-24-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-25-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-26-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-28-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-29-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-30-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-32-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-34-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-36-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2836-39-0x00000000007E0000-0x000000000189A000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e576939 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe File opened for modification C:\Windows\SYSTEM.INI 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe Token: SeDebugPrivilege 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2836 wrote to memory of 768 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 8 PID 2836 wrote to memory of 784 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 9 PID 2836 wrote to memory of 316 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 13 PID 2836 wrote to memory of 2628 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 44 PID 2836 wrote to memory of 2644 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 45 PID 2836 wrote to memory of 2892 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 51 PID 2836 wrote to memory of 3416 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 56 PID 2836 wrote to memory of 3556 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 57 PID 2836 wrote to memory of 3752 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 58 PID 2836 wrote to memory of 3844 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 59 PID 2836 wrote to memory of 3908 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 60 PID 2836 wrote to memory of 3996 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 61 PID 2836 wrote to memory of 3880 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 62 PID 2836 wrote to memory of 4580 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 74 PID 2836 wrote to memory of 2972 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 76 PID 2836 wrote to memory of 4068 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 81 PID 2836 wrote to memory of 768 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 8 PID 2836 wrote to memory of 784 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 9 PID 2836 wrote to memory of 316 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 13 PID 2836 wrote to memory of 2628 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 44 PID 2836 wrote to memory of 2644 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 45 PID 2836 wrote to memory of 2892 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 51 PID 2836 wrote to memory of 3416 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 56 PID 2836 wrote to memory of 3556 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 57 PID 2836 wrote to memory of 3752 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 58 PID 2836 wrote to memory of 3844 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 59 PID 2836 wrote to memory of 3908 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 60 PID 2836 wrote to memory of 3996 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 61 PID 2836 wrote to memory of 3880 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 62 PID 2836 wrote to memory of 4580 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 74 PID 2836 wrote to memory of 2972 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 76 PID 2836 wrote to memory of 4068 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 81 PID 2836 wrote to memory of 1364 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 84 PID 2836 wrote to memory of 4440 2836 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe 85 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2644
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2892
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe"C:\Users\Admin\AppData\Local\Temp\7e87d114f59c68f2b24ee44edd113babdfc1f775fcbdb2e9a287822fd6c7e096.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2836
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3844
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3880
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4580
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2972
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1364
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4440
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5