Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2060f96a07d5522a73f7ed77697cc5c1233183dbaca41d22828a3a2005b26f3N.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
a2060f96a07d5522a73f7ed77697cc5c1233183dbaca41d22828a3a2005b26f3N.dll
-
Size
120KB
-
MD5
c23d80dce1505239024030ab7314ef90
-
SHA1
7fee4dc4a2b9a215d4feee6dc4a5f617218fe93b
-
SHA256
a2060f96a07d5522a73f7ed77697cc5c1233183dbaca41d22828a3a2005b26f3
-
SHA512
e96dab0764292e67737a01bfc3ecdbba4b0a0754183f9b909a4cc45cd3c8c50aaca54c1292f676ed6693f61343880e087ce5757f465ff951a5103622fa92fc45
-
SSDEEP
3072:FYXUaPN7RBVhtWV84WwqbrFb3W6Iw2+n:aXrZVhtWVR43Fb3NT2+
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c1f8.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e4e2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e4e2.exe -
Executes dropped EXE 4 IoCs
pid Process 4664 e57c1f8.exe 1708 e57c36f.exe 1184 e57e4d2.exe 2408 e57e4e2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e4e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c1f8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e4e2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57e4e2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e4e2.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: e57c1f8.exe File opened (read-only) \??\I: e57c1f8.exe File opened (read-only) \??\L: e57c1f8.exe File opened (read-only) \??\N: e57c1f8.exe File opened (read-only) \??\E: e57e4e2.exe File opened (read-only) \??\E: e57c1f8.exe File opened (read-only) \??\P: e57c1f8.exe File opened (read-only) \??\H: e57e4e2.exe File opened (read-only) \??\G: e57c1f8.exe File opened (read-only) \??\H: e57c1f8.exe File opened (read-only) \??\J: e57c1f8.exe File opened (read-only) \??\K: e57c1f8.exe File opened (read-only) \??\O: e57c1f8.exe File opened (read-only) \??\G: e57e4e2.exe -
resource yara_rule behavioral2/memory/4664-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-14-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-20-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-23-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-33-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-35-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-55-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-56-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-70-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-72-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-73-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-74-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-76-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-77-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-81-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-82-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-84-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-85-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-86-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4664-94-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2408-131-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/2408-164-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57c1f8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57c1f8.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57c1f8.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57c246 e57c1f8.exe File opened for modification C:\Windows\SYSTEM.INI e57c1f8.exe File created C:\Windows\e5812d7 e57e4e2.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c1f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c36f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57e4d2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57e4e2.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4664 e57c1f8.exe 4664 e57c1f8.exe 4664 e57c1f8.exe 4664 e57c1f8.exe 2408 e57e4e2.exe 2408 e57e4e2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe Token: SeDebugPrivilege 4664 e57c1f8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 3592 1756 rundll32.exe 82 PID 1756 wrote to memory of 3592 1756 rundll32.exe 82 PID 1756 wrote to memory of 3592 1756 rundll32.exe 82 PID 3592 wrote to memory of 4664 3592 rundll32.exe 83 PID 3592 wrote to memory of 4664 3592 rundll32.exe 83 PID 3592 wrote to memory of 4664 3592 rundll32.exe 83 PID 4664 wrote to memory of 780 4664 e57c1f8.exe 9 PID 4664 wrote to memory of 788 4664 e57c1f8.exe 10 PID 4664 wrote to memory of 388 4664 e57c1f8.exe 13 PID 4664 wrote to memory of 2488 4664 e57c1f8.exe 42 PID 4664 wrote to memory of 2524 4664 e57c1f8.exe 43 PID 4664 wrote to memory of 2672 4664 e57c1f8.exe 46 PID 4664 wrote to memory of 3388 4664 e57c1f8.exe 56 PID 4664 wrote to memory of 3552 4664 e57c1f8.exe 57 PID 4664 wrote to memory of 3756 4664 e57c1f8.exe 58 PID 4664 wrote to memory of 3924 4664 e57c1f8.exe 59 PID 4664 wrote to memory of 3992 4664 e57c1f8.exe 60 PID 4664 wrote to memory of 4072 4664 e57c1f8.exe 61 PID 4664 wrote to memory of 4116 4664 e57c1f8.exe 62 PID 4664 wrote to memory of 2220 4664 e57c1f8.exe 64 PID 4664 wrote to memory of 3376 4664 e57c1f8.exe 75 PID 4664 wrote to memory of 1756 4664 e57c1f8.exe 81 PID 4664 wrote to memory of 3592 4664 e57c1f8.exe 82 PID 4664 wrote to memory of 3592 4664 e57c1f8.exe 82 PID 3592 wrote to memory of 1708 3592 rundll32.exe 84 PID 3592 wrote to memory of 1708 3592 rundll32.exe 84 PID 3592 wrote to memory of 1708 3592 rundll32.exe 84 PID 3592 wrote to memory of 1184 3592 rundll32.exe 85 PID 3592 wrote to memory of 1184 3592 rundll32.exe 85 PID 3592 wrote to memory of 1184 3592 rundll32.exe 85 PID 3592 wrote to memory of 2408 3592 rundll32.exe 86 PID 3592 wrote to memory of 2408 3592 rundll32.exe 86 PID 3592 wrote to memory of 2408 3592 rundll32.exe 86 PID 4664 wrote to memory of 780 4664 e57c1f8.exe 9 PID 4664 wrote to memory of 788 4664 e57c1f8.exe 10 PID 4664 wrote to memory of 388 4664 e57c1f8.exe 13 PID 4664 wrote to memory of 2488 4664 e57c1f8.exe 42 PID 4664 wrote to memory of 2524 4664 e57c1f8.exe 43 PID 4664 wrote to memory of 2672 4664 e57c1f8.exe 46 PID 4664 wrote to memory of 3388 4664 e57c1f8.exe 56 PID 4664 wrote to memory of 3552 4664 e57c1f8.exe 57 PID 4664 wrote to memory of 3756 4664 e57c1f8.exe 58 PID 4664 wrote to memory of 3924 4664 e57c1f8.exe 59 PID 4664 wrote to memory of 3992 4664 e57c1f8.exe 60 PID 4664 wrote to memory of 4072 4664 e57c1f8.exe 61 PID 4664 wrote to memory of 4116 4664 e57c1f8.exe 62 PID 4664 wrote to memory of 2220 4664 e57c1f8.exe 64 PID 4664 wrote to memory of 3376 4664 e57c1f8.exe 75 PID 4664 wrote to memory of 1708 4664 e57c1f8.exe 84 PID 4664 wrote to memory of 1708 4664 e57c1f8.exe 84 PID 4664 wrote to memory of 1184 4664 e57c1f8.exe 85 PID 4664 wrote to memory of 1184 4664 e57c1f8.exe 85 PID 4664 wrote to memory of 2408 4664 e57c1f8.exe 86 PID 4664 wrote to memory of 2408 4664 e57c1f8.exe 86 PID 2408 wrote to memory of 780 2408 e57e4e2.exe 9 PID 2408 wrote to memory of 788 2408 e57e4e2.exe 10 PID 2408 wrote to memory of 388 2408 e57e4e2.exe 13 PID 2408 wrote to memory of 2488 2408 e57e4e2.exe 42 PID 2408 wrote to memory of 2524 2408 e57e4e2.exe 43 PID 2408 wrote to memory of 2672 2408 e57e4e2.exe 46 PID 2408 wrote to memory of 3388 2408 e57e4e2.exe 56 PID 2408 wrote to memory of 3552 2408 e57e4e2.exe 57 PID 2408 wrote to memory of 3756 2408 e57e4e2.exe 58 PID 2408 wrote to memory of 3924 2408 e57e4e2.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c1f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e4e2.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2524
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2672
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2060f96a07d5522a73f7ed77697cc5c1233183dbaca41d22828a3a2005b26f3N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2060f96a07d5522a73f7ed77697cc5c1233183dbaca41d22828a3a2005b26f3N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\e57c1f8.exeC:\Users\Admin\AppData\Local\Temp\e57c1f8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\e57c36f.exeC:\Users\Admin\AppData\Local\Temp\e57c36f.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\e57e4d2.exeC:\Users\Admin\AppData\Local\Temp\e57e4d2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\e57e4e2.exeC:\Users\Admin\AppData\Local\Temp\e57e4e2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2408
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4072
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2220
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3376
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD558253a2f102a18d5b40d9330241fbcb4
SHA119e7319041621959bc3978f415c9bf00f29af449
SHA256ac576e9d0de839f4b11f7d10dc01a8d4b5478449c5adb7066ceac5aa3a72f3db
SHA512f523380922e1ee55a4a0075c011dfd987709c259c87bd03330b129c95c18c2b2679d2fe509d5771b1aa977f1d6ae46a7e17a3f2d8d356b0980e3520f0a3ede90
-
Filesize
257B
MD5311358df34d162c049bd79e24d9469ea
SHA10200b14972cc59b6bf05a636bd2e2e5c19e20345
SHA25633c387d098d057071f42f75a4604fd23f83e3d616692c6441e449d4e5161f482
SHA51210d05f6921c0b966d58aff70407fd71e8fddb6fe4b2cd62777f2f3da493df3e52aaa484e98e2664e17cb201aecdb13b9d26f018999de257f9fb75e1a11b5f53b