Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9519b2fac6183a0e63e67472da8306b574c1c4b79181e1b7a7e09c2ca4f84287.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
- Target 9519b2fac6183a0e63e67472da8306b574c1c4b79181e1b7a7e09c2ca4f84287.dll
- Size 120KB
- Sample241110-a2lsdsylfk
- SHA256 9519b2fac6183a0e63e67472da8306b574c1c4b79181e1b7a7e09c2ca4f84287
- MD5 c882e0a346e56e62fb0e49c023394eb6
- SHA1 045ae3a79d9c72762919d35ba8f7f3d05e8a66d5
- SHA512 0e3c69786790fbfdcbaf599be40f69d1963d801c77c732f58a28d7397a31e1926233deb4a0f7db649f91216e548b461c131051a963e1ce18b788fc267c963605
- SSDEEP 3072:uICxC3Wu7HcM5BbsTh+4wROQ2K30Qy/HE:iUBVceXXwH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576e79.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576e79.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576cd3.exe - Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579f7c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576cd3.exe - Executes dropped EXE 4 IoCs
pid Process 4608 e576cd3.exe 3744 e576e79.exe 4436 e579f5d.exe 836 e579f7c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576cd3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576e79.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579f7c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579f7c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576e79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576cd3.exe - Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e576cd3.exe File opened (read-only) \??\H: e576cd3.exe File opened (read-only) \??\I: e576cd3.exe File opened (read-only) \??\J: e576cd3.exe File opened (read-only) \??\K: e576cd3.exe File opened (read-only) \??\L: e576cd3.exe File opened (read-only) \??\E: e576cd3.exe -
resource yara_rule behavioral2/memory/4608-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-24-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-14-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-16-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-13-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-15-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-46-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-62-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-63-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-65-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-66-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-68-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-69-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4608-72-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/3744-93-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx behavioral2/memory/3744-103-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx behavioral2/memory/3744-95-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx behavioral2/memory/3744-100-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx behavioral2/memory/3744-96-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx behavioral2/memory/3744-99-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx behavioral2/memory/3744-136-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e576d31 e576cd3.exe File opened for modification C:\Windows\SYSTEM.INI e576cd3.exe File created C:\Windows\e57c023 e576e79.exe File created C:\Windows\e57e88b e579f7c.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579f7c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576cd3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576e79.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579f5d.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4608 e576cd3.exe 4608 e576cd3.exe 4608 e576cd3.exe 4608 e576cd3.exe 3744 e576e79.exe 3744 e576e79.exe 836 e579f7c.exe 836 e579f7c.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe Token: SeDebugPrivilege 4608 e576cd3.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2084 2664 rundll32.exe 85 PID 2664 wrote to memory of 2084 2664 rundll32.exe 85 PID 2664 wrote to memory of 2084 2664 rundll32.exe 85 PID 2084 wrote to memory of 4608 2084 rundll32.exe 86 PID 2084 wrote to memory of 4608 2084 rundll32.exe 86 PID 2084 wrote to memory of 4608 2084 rundll32.exe 86 PID 4608 wrote to memory of 784 4608 e576cd3.exe 8 PID 4608 wrote to memory of 792 4608 e576cd3.exe 9 PID 4608 wrote to memory of 332 4608 e576cd3.exe 13 PID 4608 wrote to memory of 2672 4608 e576cd3.exe 44 PID 4608 wrote to memory of 2696 4608 e576cd3.exe 45 PID 4608 wrote to memory of 2824 4608 e576cd3.exe 48 PID 4608 wrote to memory of 3520 4608 e576cd3.exe 56 PID 4608 wrote to memory of 3652 4608 e576cd3.exe 57 PID 4608 wrote to memory of 3836 4608 e576cd3.exe 58 PID 4608 wrote to memory of 3928 4608 e576cd3.exe 59 PID 4608 wrote to memory of 3992 4608 e576cd3.exe 60 PID 4608 wrote to memory of 4064 4608 e576cd3.exe 61 PID 4608 wrote to memory of 4144 4608 e576cd3.exe 62 PID 4608 wrote to memory of 3468 4608 e576cd3.exe 75 PID 4608 wrote to memory of 4132 4608 e576cd3.exe 76 PID 4608 wrote to memory of 4012 4608 e576cd3.exe 77 PID 4608 wrote to memory of 1384 4608 e576cd3.exe 78 PID 4608 wrote to memory of 1052 4608 e576cd3.exe 82 PID 4608 wrote to memory of 2664 4608 e576cd3.exe 84 PID 4608 wrote to memory of 2084 4608 e576cd3.exe 85 PID 4608 wrote to memory of 2084 4608 e576cd3.exe 85 PID 2084 wrote to memory of 3744 2084 rundll32.exe 87 PID 2084 wrote to memory of 3744 2084 rundll32.exe 87 PID 2084 wrote to memory of 3744 2084 rundll32.exe 87 PID 4608 wrote to memory of 784 4608 e576cd3.exe 8 PID 4608 wrote to memory of 792 4608 e576cd3.exe 9 PID 4608 wrote to memory of 332 4608 e576cd3.exe 13 PID 4608 wrote to memory of 2672 4608 e576cd3.exe 44 PID 4608 wrote to memory of 2696 4608 e576cd3.exe 45 PID 4608 wrote to memory of 2824 4608 e576cd3.exe 48 PID 4608 wrote to memory of 3520 4608 e576cd3.exe 56 PID 4608 wrote to memory of 3652 4608 e576cd3.exe 57 PID 4608 wrote to memory of 3836 4608 e576cd3.exe 58 PID 4608 wrote to memory of 3928 4608 e576cd3.exe 59 PID 4608 wrote to memory of 3992 4608 e576cd3.exe 60 PID 4608 wrote to memory of 4064 4608 e576cd3.exe 61 PID 4608 wrote to memory of 4144 4608 e576cd3.exe 62 PID 4608 wrote to memory of 3468 4608 e576cd3.exe 75 PID 4608 wrote to memory of 4132 4608 e576cd3.exe 76 PID 4608 wrote to memory of 1052 4608 e576cd3.exe 82 PID 4608 wrote to memory of 2664 4608 e576cd3.exe 84 PID 4608 wrote to memory of 3744 4608 e576cd3.exe 87 PID 4608 wrote to memory of 3744 4608 e576cd3.exe 87 PID 4608 wrote to memory of 944 4608 e576cd3.exe 89 PID 4608 wrote to memory of 3152 4608 e576cd3.exe 90 PID 2084 wrote to memory of 4436 2084 rundll32.exe 91 PID 2084 wrote to memory of 4436 2084 rundll32.exe 91 PID 2084 wrote to memory of 4436 2084 rundll32.exe 91 PID 2084 wrote to memory of 836 2084 rundll32.exe 92 PID 2084 wrote to memory of 836 2084 rundll32.exe 92 PID 2084 wrote to memory of 836 2084 rundll32.exe 92 PID 3744 wrote to memory of 784 3744 e576e79.exe 8 PID 3744 wrote to memory of 792 3744 e576e79.exe 9 PID 3744 wrote to memory of 332 3744 e576e79.exe 13 PID 3744 wrote to memory of 2672 3744 e576e79.exe 44 PID 3744 wrote to memory of 2696 3744 e576e79.exe 45 PID 3744 wrote to memory of 2824 3744 e576e79.exe 48 PID 3744 wrote to memory of 3520 3744 e576e79.exe 56 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579f7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576cd3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576e79.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2672
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2696
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2824
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9519b2fac6183a0e63e67472da8306b574c1c4b79181e1b7a7e09c2ca4f84287.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9519b2fac6183a0e63e67472da8306b574c1c4b79181e1b7a7e09c2ca4f84287.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\e576cd3.exeC:\Users\Admin\AppData\Local\Temp\e576cd3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4608
-
-
C:\Users\Admin\AppData\Local\Temp\e576e79.exeC:\Users\Admin\AppData\Local\Temp\e576e79.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3744
-
-
C:\Users\Admin\AppData\Local\Temp\e579f5d.exeC:\Users\Admin\AppData\Local\Temp\e579f5d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4436
-
-
C:\Users\Admin\AppData\Local\Temp\e579f7c.exeC:\Users\Admin\AppData\Local\Temp\e579f7c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:836
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3652
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4144
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3468
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4132
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1384
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1052
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:944
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3152
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e576cd3.exe
- Size 97KB
- SHA256 ba716fc81cd25d65f4201f2f1c942e1cd9d9c6dc91795b542805f31c10c07afb
- MD5 a1727af87eeebd8fbc8aff66670cbfde
- SHA1 d9aca67ed4fbb3abc89f0791f36a6b99c823f7bd
- SHA512 dbd9db33eed51d4937ba6e04a67e8a45e0a7cd1a6d9f2e11298ff5db80f587c3039544ea3dd1d73ccdab3bd1de20af950504abca409e1b6b215cddcbbc3bd8d4
- SSDEEP 3072:wJAMBlYueZ9Vr3C4TjUI+XOgnqsESr+goOKE:eAMBlYueZT3rjkqvOXKE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 a08542cfb0b8db979be23170ffbb4e86ee3f739aed01c3f866f61119e3a670d8
- MD5 c07be44357bab79f9c95ab902225b6ea
- SHA1 96bfacd75f460d7ad9abad5966b5e4b75aff9350
- SHA512 18c9c26ab6054e4d4d67983a51b584f42ba0b2fa883f4b240db42f8b19db24244bdc2ec94e227e45ff52b4d9ff74287432e338a0eb98b9a5abd13b473b7274d2
- MD5 SHA1 SHA512