Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/12/2024, 20:13
Behavioral task
behavioral1
Sample
123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
General
-
Target
123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe
-
Size
1.2MB
-
MD5
6e74e262ffe24121865fd9a749e1b58e
-
SHA1
96620fdcd12fdad209e9784e6ae4c316468318a4
-
SHA256
123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97
-
SHA512
669c7e9f30ca71aff9ca9b9e0225c6512d3c16a7135fb2a30326099cfc77ff4355c96271f07eea9dbfcfb033d8b05fcbb1b6cea7b026db294fc90d9f3e101081
-
SSDEEP
24576:AvcalRcz9F16LOR0wo5hStmay9wqQR0pt9mous0X/TPzQNbmO8yWqPpZTMov87:Akabcz9FCQx5X4wHbP4a3Sg
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe File opened (read-only) \??\E: 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe File opened (read-only) \??\G: 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe File opened (read-only) \??\H: 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe File opened (read-only) \??\I: 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
resource yara_rule behavioral1/memory/2460-0-0x0000000000400000-0x0000000000662000-memory.dmp upx behavioral1/memory/2460-1-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-23-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-7-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-5-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-9-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-6-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-29-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-31-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-8-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-24-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-52-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-53-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-76-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-99-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-100-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-166-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-189-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-216-0x0000000000400000-0x0000000000662000-memory.dmp upx behavioral1/memory/2460-217-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-277-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-311-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2460-331-0x0000000000400000-0x0000000000662000-memory.dmp upx behavioral1/memory/2460-354-0x0000000000400000-0x0000000000662000-memory.dmp upx behavioral1/memory/2460-335-0x0000000002240000-0x00000000032FA000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76ea5f 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe File opened for modification C:\Windows\SYSTEM.INI 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe Token: SeDebugPrivilege 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1108 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 19 PID 2460 wrote to memory of 1160 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 20 PID 2460 wrote to memory of 1208 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 21 PID 2460 wrote to memory of 1700 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 25 PID 2460 wrote to memory of 1108 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 19 PID 2460 wrote to memory of 1160 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 20 PID 2460 wrote to memory of 1208 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 21 PID 2460 wrote to memory of 1700 2460 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe"C:\Users\Admin\AppData\Local\Temp\123000bdc026d42c1c56a9947f2ae80a66c295cc00a1b3370efe81c662e9df97.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2460
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1700
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123B
MD552465d30da090047c1e95af2009cacc6
SHA1d7379c12ba6b1701d3bf57b73d44e15aa8e6ed0e
SHA25659b3d33ef10e2f4f3f93505219c230b831422ebd65478091f3b68b2b16c4615b
SHA5126aa2790547075698212fa08488b4a471fb7becae58ac9f0ae871585ad224ed9705590ad87ca5be4c18a230981142d3a0578de99a279b12d112f572143c7de75b