Analysis
-
max time kernel
32s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 00:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6bf02c737a06b0fd351029ca38879405688b9528c4b7371251223c7522882c46N.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
6bf02c737a06b0fd351029ca38879405688b9528c4b7371251223c7522882c46N.dll
-
Size
120KB
-
MD5
6ea9a0bf3a5f62e7f71b136c1356fe80
-
SHA1
c28b16a6908f3fad0069139955ab781c9b1d4425
-
SHA256
6bf02c737a06b0fd351029ca38879405688b9528c4b7371251223c7522882c46
-
SHA512
bae47019580935071ee2e8865f26238976fa5b963ac0779bd861e5efd84566b6c256d3bc5948233d2ef71d7fef2a8380e7ee9a65b1f000fd40aef593c9e30a5f
-
SSDEEP
1536:HoIy6l/Q3h66pzBPnH91Sur5kMBdJlrnvYUQm36E/OJpdckSOWefr87Fbsi3EsT4:bdpQxlBPdguqUDvYU0qkDl3w5bsilT4
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57cc97.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cc97.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cc97.exe -
Executes dropped EXE 4 IoCs
pid Process 1768 e579dc6.exe 4292 e579fab.exe 2416 e57cc97.exe 3420 e57cca6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579dc6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579dc6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cc97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cc97.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cc97.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e57cc97.exe File opened (read-only) \??\J: e57cc97.exe File opened (read-only) \??\J: e579dc6.exe File opened (read-only) \??\G: e579dc6.exe File opened (read-only) \??\I: e579dc6.exe File opened (read-only) \??\L: e579dc6.exe File opened (read-only) \??\M: e579dc6.exe File opened (read-only) \??\E: e57cc97.exe File opened (read-only) \??\H: e57cc97.exe File opened (read-only) \??\I: e57cc97.exe File opened (read-only) \??\E: e579dc6.exe File opened (read-only) \??\H: e579dc6.exe File opened (read-only) \??\K: e579dc6.exe File opened (read-only) \??\N: e579dc6.exe -
resource yara_rule behavioral2/memory/1768-6-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-8-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-9-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-18-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-12-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-11-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-10-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-31-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-27-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-19-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-35-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-36-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-37-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-38-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-39-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-45-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-57-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-62-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-64-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-65-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-66-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-68-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-71-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-75-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1768-78-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/2416-116-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/2416-159-0x0000000000730000-0x00000000017EA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e579e63 e579dc6.exe File opened for modification C:\Windows\SYSTEM.INI e579dc6.exe File created C:\Windows\e57f3d6 e57cc97.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579fab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cc97.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cca6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579dc6.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1768 e579dc6.exe 1768 e579dc6.exe 1768 e579dc6.exe 1768 e579dc6.exe 2416 e57cc97.exe 2416 e57cc97.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe Token: SeDebugPrivilege 1768 e579dc6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 5012 2116 rundll32.exe 83 PID 2116 wrote to memory of 5012 2116 rundll32.exe 83 PID 2116 wrote to memory of 5012 2116 rundll32.exe 83 PID 5012 wrote to memory of 1768 5012 rundll32.exe 84 PID 5012 wrote to memory of 1768 5012 rundll32.exe 84 PID 5012 wrote to memory of 1768 5012 rundll32.exe 84 PID 1768 wrote to memory of 792 1768 e579dc6.exe 8 PID 1768 wrote to memory of 796 1768 e579dc6.exe 9 PID 1768 wrote to memory of 64 1768 e579dc6.exe 13 PID 1768 wrote to memory of 2744 1768 e579dc6.exe 50 PID 1768 wrote to memory of 2780 1768 e579dc6.exe 51 PID 1768 wrote to memory of 2992 1768 e579dc6.exe 52 PID 1768 wrote to memory of 3428 1768 e579dc6.exe 56 PID 1768 wrote to memory of 3568 1768 e579dc6.exe 57 PID 1768 wrote to memory of 3748 1768 e579dc6.exe 58 PID 1768 wrote to memory of 3840 1768 e579dc6.exe 59 PID 1768 wrote to memory of 3904 1768 e579dc6.exe 60 PID 1768 wrote to memory of 3988 1768 e579dc6.exe 61 PID 1768 wrote to memory of 4104 1768 e579dc6.exe 62 PID 1768 wrote to memory of 2412 1768 e579dc6.exe 74 PID 1768 wrote to memory of 2284 1768 e579dc6.exe 76 PID 1768 wrote to memory of 3164 1768 e579dc6.exe 81 PID 1768 wrote to memory of 2116 1768 e579dc6.exe 82 PID 1768 wrote to memory of 5012 1768 e579dc6.exe 83 PID 1768 wrote to memory of 5012 1768 e579dc6.exe 83 PID 5012 wrote to memory of 4292 5012 rundll32.exe 85 PID 5012 wrote to memory of 4292 5012 rundll32.exe 85 PID 5012 wrote to memory of 4292 5012 rundll32.exe 85 PID 1768 wrote to memory of 792 1768 e579dc6.exe 8 PID 1768 wrote to memory of 796 1768 e579dc6.exe 9 PID 1768 wrote to memory of 64 1768 e579dc6.exe 13 PID 1768 wrote to memory of 2744 1768 e579dc6.exe 50 PID 1768 wrote to memory of 2780 1768 e579dc6.exe 51 PID 1768 wrote to memory of 2992 1768 e579dc6.exe 52 PID 1768 wrote to memory of 3428 1768 e579dc6.exe 56 PID 1768 wrote to memory of 3568 1768 e579dc6.exe 57 PID 1768 wrote to memory of 3748 1768 e579dc6.exe 58 PID 1768 wrote to memory of 3840 1768 e579dc6.exe 59 PID 1768 wrote to memory of 3904 1768 e579dc6.exe 60 PID 1768 wrote to memory of 3988 1768 e579dc6.exe 61 PID 1768 wrote to memory of 4104 1768 e579dc6.exe 62 PID 1768 wrote to memory of 2412 1768 e579dc6.exe 74 PID 1768 wrote to memory of 2284 1768 e579dc6.exe 76 PID 1768 wrote to memory of 3164 1768 e579dc6.exe 81 PID 1768 wrote to memory of 2116 1768 e579dc6.exe 82 PID 1768 wrote to memory of 4292 1768 e579dc6.exe 85 PID 1768 wrote to memory of 4292 1768 e579dc6.exe 85 PID 5012 wrote to memory of 2416 5012 rundll32.exe 86 PID 5012 wrote to memory of 2416 5012 rundll32.exe 86 PID 5012 wrote to memory of 2416 5012 rundll32.exe 86 PID 5012 wrote to memory of 3420 5012 rundll32.exe 87 PID 5012 wrote to memory of 3420 5012 rundll32.exe 87 PID 5012 wrote to memory of 3420 5012 rundll32.exe 87 PID 2416 wrote to memory of 792 2416 e57cc97.exe 8 PID 2416 wrote to memory of 796 2416 e57cc97.exe 9 PID 2416 wrote to memory of 64 2416 e57cc97.exe 13 PID 2416 wrote to memory of 2744 2416 e57cc97.exe 50 PID 2416 wrote to memory of 2780 2416 e57cc97.exe 51 PID 2416 wrote to memory of 2992 2416 e57cc97.exe 52 PID 2416 wrote to memory of 3428 2416 e57cc97.exe 56 PID 2416 wrote to memory of 3568 2416 e57cc97.exe 57 PID 2416 wrote to memory of 3748 2416 e57cc97.exe 58 PID 2416 wrote to memory of 3840 2416 e57cc97.exe 59 PID 2416 wrote to memory of 3904 2416 e57cc97.exe 60 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579dc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cc97.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2780
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2992
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6bf02c737a06b0fd351029ca38879405688b9528c4b7371251223c7522882c46N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6bf02c737a06b0fd351029ca38879405688b9528c4b7371251223c7522882c46N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\e579dc6.exeC:\Users\Admin\AppData\Local\Temp\e579dc6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\e579fab.exeC:\Users\Admin\AppData\Local\Temp\e579fab.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4292
-
-
C:\Users\Admin\AppData\Local\Temp\e57cc97.exeC:\Users\Admin\AppData\Local\Temp\e57cc97.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\e57cca6.exeC:\Users\Admin\AppData\Local\Temp\e57cca6.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3420
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3988
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4104
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2412
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2284
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3164
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD50e81c36a1f6e96a95c8c7bb3a0205429
SHA1a8c183f0414416dd38ef3b015ffd74387d252ce2
SHA25680c15f83ce7de9025c00bcf65297ecd0d1b6557d1d5d0b8021303a3c2489dc70
SHA512957da0c4cabe4a3e19baa93ba3fd80725c59b0451b8fd6b2f9995c60000696fb66487bb25d5884e14ec60efa49b5fd165fffd5714d2b4f99e20d8532fd7ed490
-
Filesize
257B
MD5d7f84803a9a9142a3ac8d83e9f949d3e
SHA1a550a012f3fe4548a7ff9ad1c912f0cecddf9c5e
SHA25623877e2d9fbd13174aa2e301f50542ee0b1db66d5d6cab5ce58db001a62a00ee
SHA5120b1c14028374acdd22bbf37730e9468ab800569a035f15de0e95d46aeca23c32752c47327aa1f393444daa06667effeb11b6846254426edfd632640bac657d41