Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 12:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
General
-
Target
50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe
-
Size
100KB
-
MD5
3bff73ebb285412cecf40b1a07904fac
-
SHA1
22a3ccd5da27c37b2b46726c6c37ab2e88f9c8cc
-
SHA256
50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070
-
SHA512
437fc718339d0c16fc99ab74263e47941ea037fb9b6c34a7dc0490cc0c4388c0461507317a39798a4a1cc5fb6da72359b44386a7b2092e11b2e00eae500f2eec
-
SSDEEP
3072:dEsnXYHkeQuAMQd63dWxJG3LJj4YjuQvbbJs:dEaXOQuAVENOG7cQvbbJs
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Disables Task Manager via registry modification
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\U: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\W: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\Y: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\G: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\R: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\S: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\Z: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\M: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\V: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\X: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\K: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\L: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\N: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\O: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\P: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\E: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\H: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\I: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\Q: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened (read-only) \??\T: 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification F:\autorun.inf 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
resource yara_rule behavioral2/memory/2388-5-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-3-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-6-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-4-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-7-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-1-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-8-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-13-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-15-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-14-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-16-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-17-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-18-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-19-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-20-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-22-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-23-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-24-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-27-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-28-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-30-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-32-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-35-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-37-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-38-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-39-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-40-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-44-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-46-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-47-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-48-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-56-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-57-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-60-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-62-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-64-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-67-0x0000000002260000-0x00000000032EE000-memory.dmp upx behavioral2/memory/2388-68-0x0000000002260000-0x00000000032EE000-memory.dmp upx -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe Token: SeDebugPrivilege 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 772 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 8 PID 2388 wrote to memory of 776 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 9 PID 2388 wrote to memory of 64 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 13 PID 2388 wrote to memory of 3028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 50 PID 2388 wrote to memory of 2784 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 51 PID 2388 wrote to memory of 3100 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 52 PID 2388 wrote to memory of 3424 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 56 PID 2388 wrote to memory of 3556 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 57 PID 2388 wrote to memory of 3744 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 58 PID 2388 wrote to memory of 3840 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 59 PID 2388 wrote to memory of 3912 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 60 PID 2388 wrote to memory of 4000 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 61 PID 2388 wrote to memory of 4124 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 62 PID 2388 wrote to memory of 1732 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 75 PID 2388 wrote to memory of 2028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 76 PID 2388 wrote to memory of 772 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 8 PID 2388 wrote to memory of 776 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 9 PID 2388 wrote to memory of 64 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 13 PID 2388 wrote to memory of 3028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 50 PID 2388 wrote to memory of 2784 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 51 PID 2388 wrote to memory of 3100 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 52 PID 2388 wrote to memory of 3424 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 56 PID 2388 wrote to memory of 3556 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 57 PID 2388 wrote to memory of 3744 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 58 PID 2388 wrote to memory of 3840 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 59 PID 2388 wrote to memory of 3912 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 60 PID 2388 wrote to memory of 4000 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 61 PID 2388 wrote to memory of 4124 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 62 PID 2388 wrote to memory of 1732 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 75 PID 2388 wrote to memory of 2028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 76 PID 2388 wrote to memory of 772 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 8 PID 2388 wrote to memory of 776 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 9 PID 2388 wrote to memory of 64 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 13 PID 2388 wrote to memory of 3028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 50 PID 2388 wrote to memory of 2784 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 51 PID 2388 wrote to memory of 3100 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 52 PID 2388 wrote to memory of 3424 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 56 PID 2388 wrote to memory of 3556 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 57 PID 2388 wrote to memory of 3744 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 58 PID 2388 wrote to memory of 3840 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 59 PID 2388 wrote to memory of 3912 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 60 PID 2388 wrote to memory of 4000 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 61 PID 2388 wrote to memory of 4124 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 62 PID 2388 wrote to memory of 1732 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 75 PID 2388 wrote to memory of 2028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 76 PID 2388 wrote to memory of 772 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 8 PID 2388 wrote to memory of 776 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 9 PID 2388 wrote to memory of 64 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 13 PID 2388 wrote to memory of 3028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 50 PID 2388 wrote to memory of 2784 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 51 PID 2388 wrote to memory of 3100 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 52 PID 2388 wrote to memory of 3424 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 56 PID 2388 wrote to memory of 3556 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 57 PID 2388 wrote to memory of 3744 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 58 PID 2388 wrote to memory of 3840 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 59 PID 2388 wrote to memory of 3912 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 60 PID 2388 wrote to memory of 4000 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 61 PID 2388 wrote to memory of 4124 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 62 PID 2388 wrote to memory of 1732 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 75 PID 2388 wrote to memory of 2028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 76 PID 2388 wrote to memory of 772 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 8 PID 2388 wrote to memory of 776 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 9 PID 2388 wrote to memory of 64 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 13 PID 2388 wrote to memory of 3028 2388 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe 50 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2784
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3100
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe"C:\Users\Admin\AppData\Local\Temp\50294b9112012133424fb7b887557cffd739bd7e3dd16a007267dde20f19e070.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2388
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1732
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2028
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5b2db6a7ced0f0827aee41bd0fcc9aa31
SHA1dce02e7a1cf76c2d01c7f2f654f93a7a0f7939dc
SHA2563046944297df4e84065abd6e490b29d72edffc15c6d6379562288993d7594b84
SHA5121580386e4258e177ad851e730deb17d3905b5933922afec4486920c2dbe93df59a4957bbf6090d9d37269f3b558adf28c3278b32bd608df8494ef931951be381