Analysis
-
max time kernel
123s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 11:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
General
-
Target
20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe
-
Size
116KB
-
MD5
521cbe25dfee2700b78e9e806eb7d7f1
-
SHA1
0542806453c9d08800aa4ad62191259d6f1517c1
-
SHA256
20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9
-
SHA512
74df7e3cf1772b72209c82d98e7b056616f165e835ed96d3e5e156ad0e943e17a8092172075c5ae3b7ba9b0384862b9323b582ca0bc71f931403aa9b16f049a9
-
SSDEEP
3072:JYK60a3KAlQq8wcRBongM7JRgSnGi+qbu4iZV:J/60At8wcXog4JRg5T4E
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\M: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\N: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\T: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\Z: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\G: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\Q: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\S: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\Y: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\J: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\O: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\P: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\R: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\U: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\V: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\X: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\E: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\I: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\L: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\W: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened (read-only) \??\H: 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened for modification F:\autorun.inf 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
resource yara_rule behavioral1/memory/1740-1-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-3-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-6-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-4-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-5-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-8-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-10-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-7-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-9-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-28-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-29-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-30-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-32-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-31-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-34-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-51-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-52-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-53-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-57-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-58-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-60-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-61-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-65-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-72-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral1/memory/1740-74-0x00000000024C0000-0x000000000354E000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe Token: SeDebugPrivilege 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 2888 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 30 PID 1740 wrote to memory of 2888 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 30 PID 1740 wrote to memory of 2888 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 30 PID 1740 wrote to memory of 2888 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 30 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 PID 1740 wrote to memory of 1128 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 19 PID 1740 wrote to memory of 1192 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 20 PID 1740 wrote to memory of 1240 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 21 PID 1740 wrote to memory of 864 1740 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe"C:\Users\Admin\AppData\Local\Temp\20e2e50cde410b0b21f78a3ae08cbe4460900924294d88b72c487c42d11e66d9.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c c:\frpc.exe -c c:\frpc.ini3⤵
- System Location Discovery: System Language Discovery
PID:2888
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:864
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5f78b043e74e95ed4bda885272a50ca24
SHA1faef05e2c0906fd5063fe4de3f928ab1aa5acf64
SHA256b292da5458f7df5bb7b03162f93e8979d62b6120d7469fc0b935005434613618
SHA512bde110ce0031890ad5b800229e0c5eb5c1fa1e4f88fca5bcd6821449ad6ee1ab814d469eb2e0bcd5080239deb7487d061dd02e4754df56a778963bf3db4e00a6