Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e7cb606c44fc0a1b236b26501a1168e60901d34e234a5768bf12338d5303d678.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
General
-
Target
e7cb606c44fc0a1b236b26501a1168e60901d34e234a5768bf12338d5303d678.dll
-
Size
120KB
-
MD5
f0b2150d07891fdfdef4de67fb7314d7
-
SHA1
8f4bc4cea5955e57dbbc18b3518535ef39c36a68
-
SHA256
e7cb606c44fc0a1b236b26501a1168e60901d34e234a5768bf12338d5303d678
-
SHA512
521c7674f99bca4900f93f7f4e2eeaf78d4d3ee92403103a86b05e7d3b4bba8be05ef3f6bd4df0c8aef15c7c93fee2d192c9e817fe2d1c1d40d3eb747cc70d4c
-
SSDEEP
3072:YFkOYBipsDgIl/R0KEHNRjRkLLB0HKILE0T9BZh6bw:Y+OqipuytRjiZ0Htnngw
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577937.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577937.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575dcf.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577937.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575dcf.exe -
Executes dropped EXE 3 IoCs
pid Process 4352 e575dcf.exe 2100 e57606f.exe 4804 e577937.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577937.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577937.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577937.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577937.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e575dcf.exe File opened (read-only) \??\Q: e575dcf.exe File opened (read-only) \??\R: e575dcf.exe File opened (read-only) \??\E: e575dcf.exe File opened (read-only) \??\G: e575dcf.exe File opened (read-only) \??\K: e575dcf.exe File opened (read-only) \??\N: e575dcf.exe File opened (read-only) \??\J: e575dcf.exe File opened (read-only) \??\L: e575dcf.exe File opened (read-only) \??\O: e575dcf.exe File opened (read-only) \??\P: e575dcf.exe File opened (read-only) \??\H: e575dcf.exe File opened (read-only) \??\M: e575dcf.exe File opened (read-only) \??\S: e575dcf.exe -
resource yara_rule behavioral2/memory/4352-6-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-17-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-32-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-33-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-34-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-30-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-35-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-41-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-42-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-51-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-54-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-55-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-65-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-67-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-70-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-72-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-73-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-74-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-75-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-77-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-80-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-82-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4352-87-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4804-120-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4804-146-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e575dcf.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e575dcf.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e575dcf.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e575dcf.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e575f95 e575dcf.exe File opened for modification C:\Windows\SYSTEM.INI e575dcf.exe File created C:\Windows\e57b71b e577937.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e575dcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57606f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e577937.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4352 e575dcf.exe 4352 e575dcf.exe 4352 e575dcf.exe 4352 e575dcf.exe 4804 e577937.exe 4804 e577937.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe Token: SeDebugPrivilege 4352 e575dcf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 1984 2808 rundll32.exe 85 PID 2808 wrote to memory of 1984 2808 rundll32.exe 85 PID 2808 wrote to memory of 1984 2808 rundll32.exe 85 PID 1984 wrote to memory of 4352 1984 rundll32.exe 86 PID 1984 wrote to memory of 4352 1984 rundll32.exe 86 PID 1984 wrote to memory of 4352 1984 rundll32.exe 86 PID 4352 wrote to memory of 796 4352 e575dcf.exe 8 PID 4352 wrote to memory of 804 4352 e575dcf.exe 9 PID 4352 wrote to memory of 380 4352 e575dcf.exe 13 PID 4352 wrote to memory of 2396 4352 e575dcf.exe 42 PID 4352 wrote to memory of 2424 4352 e575dcf.exe 43 PID 4352 wrote to memory of 2516 4352 e575dcf.exe 44 PID 4352 wrote to memory of 3516 4352 e575dcf.exe 56 PID 4352 wrote to memory of 3624 4352 e575dcf.exe 57 PID 4352 wrote to memory of 3820 4352 e575dcf.exe 58 PID 4352 wrote to memory of 3908 4352 e575dcf.exe 59 PID 4352 wrote to memory of 3972 4352 e575dcf.exe 60 PID 4352 wrote to memory of 4052 4352 e575dcf.exe 61 PID 4352 wrote to memory of 2588 4352 e575dcf.exe 62 PID 4352 wrote to memory of 4924 4352 e575dcf.exe 75 PID 4352 wrote to memory of 2332 4352 e575dcf.exe 76 PID 4352 wrote to memory of 2060 4352 e575dcf.exe 77 PID 4352 wrote to memory of 2412 4352 e575dcf.exe 78 PID 4352 wrote to memory of 2072 4352 e575dcf.exe 83 PID 4352 wrote to memory of 2808 4352 e575dcf.exe 84 PID 4352 wrote to memory of 1984 4352 e575dcf.exe 85 PID 4352 wrote to memory of 1984 4352 e575dcf.exe 85 PID 1984 wrote to memory of 2100 1984 rundll32.exe 87 PID 1984 wrote to memory of 2100 1984 rundll32.exe 87 PID 1984 wrote to memory of 2100 1984 rundll32.exe 87 PID 1984 wrote to memory of 4804 1984 rundll32.exe 88 PID 1984 wrote to memory of 4804 1984 rundll32.exe 88 PID 1984 wrote to memory of 4804 1984 rundll32.exe 88 PID 4352 wrote to memory of 796 4352 e575dcf.exe 8 PID 4352 wrote to memory of 804 4352 e575dcf.exe 9 PID 4352 wrote to memory of 380 4352 e575dcf.exe 13 PID 4352 wrote to memory of 2396 4352 e575dcf.exe 42 PID 4352 wrote to memory of 2424 4352 e575dcf.exe 43 PID 4352 wrote to memory of 2516 4352 e575dcf.exe 44 PID 4352 wrote to memory of 3516 4352 e575dcf.exe 56 PID 4352 wrote to memory of 3624 4352 e575dcf.exe 57 PID 4352 wrote to memory of 3820 4352 e575dcf.exe 58 PID 4352 wrote to memory of 3908 4352 e575dcf.exe 59 PID 4352 wrote to memory of 3972 4352 e575dcf.exe 60 PID 4352 wrote to memory of 4052 4352 e575dcf.exe 61 PID 4352 wrote to memory of 2588 4352 e575dcf.exe 62 PID 4352 wrote to memory of 4924 4352 e575dcf.exe 75 PID 4352 wrote to memory of 2332 4352 e575dcf.exe 76 PID 4352 wrote to memory of 2060 4352 e575dcf.exe 77 PID 4352 wrote to memory of 2412 4352 e575dcf.exe 78 PID 4352 wrote to memory of 2100 4352 e575dcf.exe 87 PID 4352 wrote to memory of 2100 4352 e575dcf.exe 87 PID 4352 wrote to memory of 4804 4352 e575dcf.exe 88 PID 4352 wrote to memory of 4804 4352 e575dcf.exe 88 PID 4804 wrote to memory of 796 4804 e577937.exe 8 PID 4804 wrote to memory of 804 4804 e577937.exe 9 PID 4804 wrote to memory of 380 4804 e577937.exe 13 PID 4804 wrote to memory of 2396 4804 e577937.exe 42 PID 4804 wrote to memory of 2424 4804 e577937.exe 43 PID 4804 wrote to memory of 2516 4804 e577937.exe 44 PID 4804 wrote to memory of 3516 4804 e577937.exe 56 PID 4804 wrote to memory of 3624 4804 e577937.exe 57 PID 4804 wrote to memory of 3820 4804 e577937.exe 58 PID 4804 wrote to memory of 3908 4804 e577937.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577937.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2424
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2516
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7cb606c44fc0a1b236b26501a1168e60901d34e234a5768bf12338d5303d678.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7cb606c44fc0a1b236b26501a1168e60901d34e234a5768bf12338d5303d678.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\e575dcf.exeC:\Users\Admin\AppData\Local\Temp\e575dcf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4352
-
-
C:\Users\Admin\AppData\Local\Temp\e57606f.exeC:\Users\Admin\AppData\Local\Temp\e57606f.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100
-
-
C:\Users\Admin\AppData\Local\Temp\e577937.exeC:\Users\Admin\AppData\Local\Temp\e577937.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4804
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3624
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3820
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3908
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3972
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4052
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2588
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2332
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2060
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2412
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2072
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD51af7f1f56ebf2527790c00a8e770ad99
SHA11790b8b2fa68a147d307e7883bb065f4ec4be5cc
SHA2563abfcf8683979b3822cb77d62b43ccd9b07f4b17642ea19896d35aa31cd3a5fa
SHA512bba54cf1b7f4b7bc992cb4fdc602a45dfbb48ccb589dfbdea5a6b888a7f0969bfb159d236a3cd9bf21810d05be3e413df059efe116ee8cca14ebf3ed5ae9e040
-
Filesize
257B
MD547abc17b0dec651a58a0ee9fde73ac1b
SHA1d9bc8a2e7603034f32eb9aef7a761c7f5929004c
SHA256f1ed66cc00eb01f765d315d7c5617682d45d3fb6b7b3f6a28981a6f0d1af4e80
SHA5123fe9238f639d14177e11b25572618520bf119152e97cb3773a49a1a4f0b96a8023ae0623824256f60af041113495b9aabe2460bd08a0ca9f64878ed51972607b