Analysis
-
max time kernel
123s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/12/2024, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe
-
Size
1.2MB
-
MD5
2c73ddb33c7d5b00141a855fa75f41a6
-
SHA1
b0c99c382bb4088aea00f6a3e33b4585e82691e7
-
SHA256
f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93
-
SHA512
db28f4be1cd33ba627725d4029bd89d55f979cdc1ecd409166276585dc84f739ed7b3407c8dddce1103eb18617f666ee89f114f2c56731907683a717e2d0d82b
-
SSDEEP
24576:C8+8EL5BMYsVNRV59BuiJqueyyGmGanfGXXvriy2dYCf6Yq41twdKv1KxckwF7hO:C8A0NRV59BuiJqueyyGmGanfGXXvriyT
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\H: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\L: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\T: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\W: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\I: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\J: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\U: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\V: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\X: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\E: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\M: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\N: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\O: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\P: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\Q: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\R: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\S: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\G: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\K: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened (read-only) \??\Z: f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened for modification C:\autorun.inf f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
resource yara_rule behavioral1/memory/2364-1-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-5-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-7-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-3-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-10-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-4-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-8-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-6-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-9-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-12-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-11-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-34-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-35-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-36-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-38-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-37-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-40-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-92-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-93-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-94-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-104-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-106-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-108-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-109-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-112-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-115-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-176-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-177-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-232-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx behavioral1/memory/2364-233-0x0000000001FF0000-0x00000000030AA000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened for modification C:\Program Files\7-Zip\7z.exe f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened for modification C:\Program Files\7-Zip\7zG.exe f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f770ff8 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe File opened for modification C:\Windows\SYSTEM.INI f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe Token: SeDebugPrivilege 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 PID 2364 wrote to memory of 1104 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 19 PID 2364 wrote to memory of 1172 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 20 PID 2364 wrote to memory of 1200 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 21 PID 2364 wrote to memory of 1324 2364 f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe"C:\Users\Admin\AppData\Local\Temp\f7090c7e2b3a4b84806b92b33b31ab5eb3b2f3578f41eebe1c99782e3f17bb93.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2364
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1324
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
899B
MD52cbb661d0cf4a0dbe590f575cf3aa904
SHA13cb8420d0ba9e2e2dd3618b91459f53e7823da99
SHA25616bed0ca7b552dc4b70d14a8b4289b01a116d906b4c0b57eb46bb9fde3117e1f
SHA5123923a0a5ff3c9c8f78e765f26ec6acf4f80e5a5a8bb40021855c43b0fb92d0fbe5826912b7c00ec8439fcb6c6474c467b72b639c5567207ee00793088a26091b
-
Filesize
899B
MD5e1ba99a8ae393fbf6fa8c34df07269db
SHA1f6011102a3d21bd4bb05f9c75572ecbe52544252
SHA256ea203b3419723c791eb4a76f1b3a223b105556839df769ba177354b9d5bc4636
SHA5120166ebb1a9c7c2b7806311f83aee72836583a9ac42373f89de736d1bdf0b30083a2118479ef6ccf6db5c344b2c9609e70defc0ce5f2197e3cccaf22d9ad7c685
-
Filesize
899B
MD55f032a0ee395dcbe248c607fdc48ee47
SHA1e2bd0bfcb6f3f8d5766bfb2c4074bedb6c0cf71f
SHA2569466f1355c4a777ff7e368aaa0561589b914d5c10eedead22e6ab0a2d72a7a91
SHA512ee0658dda803bf2d8937b960119e4e37c6b9a710b8bf1948bc4c1f21a62f83a23844920fdeba7bfc77ec66b4993c75dc5d956217b7609ab2ae27a6b861c4b3bc
-
Filesize
97KB
MD528dce9f38930e0da4234c7ca1aa35cfa
SHA15a67b91e9fd56a5817a8255d56721e2048eae978
SHA2564a4853bfeb0096cfd5a676058906260ee2d38ed4ba246d0cfd838408f1dd87fb
SHA5129c8fb3c2ee800ba2379e9f55413b9bb32e8e62ad88bcb6b7e71783991d333812889bd8aff78f32851d7482e15b56824f6d174e59b52881ecba4021057c27d555