Analysis
-
max time kernel
35s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 19:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
General
-
Target
9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe
-
Size
3.7MB
-
MD5
3df0263434816d1f30983867c5ee4ae0
-
SHA1
6a8686987f161ef03e7088079a2c6e6a5adab485
-
SHA256
9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681
-
SHA512
fa0e884df0bb1640ab326d53fe302ef52f7cce9dea5b059c7ec109c32c5f8920a026296df6ac1e09bdf2a55aaa245598061be14142a2635f50d5930de6819784
-
SSDEEP
98304:LP6HSaC1lfCng7PAu6FNxvWbrtUTrUHOi:LP6yaefhkpNx+NcIOi
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe -
Deletes itself 1 IoCs
pid Process 2224 explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe -
resource yara_rule behavioral2/memory/4512-6-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-8-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-7-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-9-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-14-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-17-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-3-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-4-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-5-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-1-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/4512-23-0x0000000002520000-0x00000000035AE000-memory.dmp upx behavioral2/memory/2224-34-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-36-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-37-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-38-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-39-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-40-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-41-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-42-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-43-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-44-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-45-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-46-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-47-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-48-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-50-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-51-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-52-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-54-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-60-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-62-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-64-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-63-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-68-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-70-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-72-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-74-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-76-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/2224-77-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5028 4512 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe Token: SeDebugPrivilege 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4512 wrote to memory of 2224 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 82 PID 4512 wrote to memory of 2224 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 82 PID 4512 wrote to memory of 2224 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 82 PID 4512 wrote to memory of 776 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 8 PID 4512 wrote to memory of 784 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 9 PID 4512 wrote to memory of 64 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 13 PID 4512 wrote to memory of 2872 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 49 PID 4512 wrote to memory of 2920 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 50 PID 4512 wrote to memory of 2992 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 51 PID 4512 wrote to memory of 3468 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 56 PID 4512 wrote to memory of 3600 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 57 PID 4512 wrote to memory of 3780 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 58 PID 4512 wrote to memory of 3872 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 59 PID 4512 wrote to memory of 3940 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 60 PID 4512 wrote to memory of 4012 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 61 PID 4512 wrote to memory of 4224 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 62 PID 4512 wrote to memory of 1456 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 74 PID 4512 wrote to memory of 2932 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 76 PID 4512 wrote to memory of 2224 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 82 PID 4512 wrote to memory of 2224 4512 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe 82 PID 2224 wrote to memory of 776 2224 explorer.exe 8 PID 2224 wrote to memory of 784 2224 explorer.exe 9 PID 2224 wrote to memory of 64 2224 explorer.exe 13 PID 2224 wrote to memory of 2872 2224 explorer.exe 49 PID 2224 wrote to memory of 2920 2224 explorer.exe 50 PID 2224 wrote to memory of 2992 2224 explorer.exe 51 PID 2224 wrote to memory of 3468 2224 explorer.exe 56 PID 2224 wrote to memory of 3600 2224 explorer.exe 57 PID 2224 wrote to memory of 3780 2224 explorer.exe 58 PID 2224 wrote to memory of 3872 2224 explorer.exe 59 PID 2224 wrote to memory of 3940 2224 explorer.exe 60 PID 2224 wrote to memory of 4012 2224 explorer.exe 61 PID 2224 wrote to memory of 4224 2224 explorer.exe 62 PID 2224 wrote to memory of 1456 2224 explorer.exe 74 PID 2224 wrote to memory of 2932 2224 explorer.exe 76 PID 2224 wrote to memory of 776 2224 explorer.exe 8 PID 2224 wrote to memory of 784 2224 explorer.exe 9 PID 2224 wrote to memory of 64 2224 explorer.exe 13 PID 2224 wrote to memory of 2872 2224 explorer.exe 49 PID 2224 wrote to memory of 2920 2224 explorer.exe 50 PID 2224 wrote to memory of 2992 2224 explorer.exe 51 PID 2224 wrote to memory of 3468 2224 explorer.exe 56 PID 2224 wrote to memory of 3600 2224 explorer.exe 57 PID 2224 wrote to memory of 3780 2224 explorer.exe 58 PID 2224 wrote to memory of 3872 2224 explorer.exe 59 PID 2224 wrote to memory of 3940 2224 explorer.exe 60 PID 2224 wrote to memory of 4012 2224 explorer.exe 61 PID 2224 wrote to memory of 4224 2224 explorer.exe 62 PID 2224 wrote to memory of 1456 2224 explorer.exe 74 PID 2224 wrote to memory of 2932 2224 explorer.exe 76 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2920
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2992
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe"C:\Users\Admin\AppData\Local\Temp\9c94c75dc5a732aba6d65ccf0309dc7e5f83855af51de165b75aae0ba180b681N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4512 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 8363⤵
- Program crash
PID:5028
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3600
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3780
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3872
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3940
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4224
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1456
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4512 -ip 45121⤵PID:4880
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5fd996c4d589c94bb9f8b5a0b480c0c9b
SHA1e58d7f65bfb71f61e9430d8153b88d5443059fd6
SHA256b64503b87e327c43ce9044ee2321662b86e1430ed5a8fa5d914f9b2618fc023e
SHA5124c000b41e429e25758e5f6d88fa93c7fdf38c5ef14b1a11b5e1875f7744a5af3b889d8f051a06224867826f58c7149d01dd24a73af5bd016b3ac56abdb994eb9
-
Filesize
100KB
MD58ea315f5400e18cfe1fd3f336d5334de
SHA14bfae37d7b4296ebcc5ff49d5a6782e8a14cfab8
SHA2565b34b7f3907cc8fa964cf48a5a4463faf7de706dc5c210507aaf648eb34cf47f
SHA512cdc7d3df48eea0d476a7bfec76de5153f18bd246f3c0d63ca9058405c3b3086ce5824df4717c0b84ffe6025fbcaf09ddb6bcf9a6b5fd3731c29424d5c895161f