Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de7e77a3ff2cf4897177c46aa284f50644671e58d0e1793b487854dd34e60757N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
de7e77a3ff2cf4897177c46aa284f50644671e58d0e1793b487854dd34e60757N.dll
-
Size
120KB
-
MD5
f087713cbf3a5cc44abb1b110f7ddbe0
-
SHA1
a0d0ba4c5580a5ac80a2ce4cf54c21d8d3674066
-
SHA256
de7e77a3ff2cf4897177c46aa284f50644671e58d0e1793b487854dd34e60757
-
SHA512
81860ba0c8db998582b1009d914e337c28b540d6e16b13d3c198cb558b8fcbde9e15ec14485f36fa88531d5871fdc0280fd7ff06ef0507178503480644a60316
-
SSDEEP
1536:NsvKA0c9wqGmXVGt0hKfaxVccXM4a7CdZnl1hzDOihkFoqumiV+vJ2//jhjSC:kR5hGmX+L8Vc97mlfGimFtuz+BaFF
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57953b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57953b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5779a4.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57953b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5779a4.exe -
Executes dropped EXE 4 IoCs
pid Process 804 e5779a4.exe 3336 e577abe.exe 2112 e57952b.exe 2912 e57953b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57953b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5779a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57953b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57953b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57953b.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e5779a4.exe File opened (read-only) \??\K: e5779a4.exe File opened (read-only) \??\O: e5779a4.exe File opened (read-only) \??\H: e5779a4.exe File opened (read-only) \??\R: e5779a4.exe File opened (read-only) \??\S: e5779a4.exe File opened (read-only) \??\E: e5779a4.exe File opened (read-only) \??\J: e5779a4.exe File opened (read-only) \??\M: e5779a4.exe File opened (read-only) \??\P: e5779a4.exe File opened (read-only) \??\G: e57953b.exe File opened (read-only) \??\E: e57953b.exe File opened (read-only) \??\I: e5779a4.exe File opened (read-only) \??\L: e5779a4.exe File opened (read-only) \??\N: e5779a4.exe File opened (read-only) \??\Q: e5779a4.exe File opened (read-only) \??\T: e5779a4.exe -
resource yara_rule behavioral2/memory/804-6-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-9-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-18-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-28-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-23-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-12-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-11-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-10-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-8-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-33-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-35-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-36-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-37-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-38-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-39-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-41-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-42-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-57-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-59-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-61-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-74-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-75-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-79-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-81-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-83-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-85-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-86-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-88-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-89-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-90-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-97-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/804-99-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2912-132-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/2912-168-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5779a4.exe File opened for modification C:\Program Files\7-Zip\7z.exe e5779a4.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5779a4.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5779a4.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e577a12 e5779a4.exe File opened for modification C:\Windows\SYSTEM.INI e5779a4.exe File created C:\Windows\e57c9d8 e57953b.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57952b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57953b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5779a4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e577abe.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 804 e5779a4.exe 804 e5779a4.exe 804 e5779a4.exe 804 e5779a4.exe 2912 e57953b.exe 2912 e57953b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe Token: SeDebugPrivilege 804 e5779a4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 3444 4884 rundll32.exe 82 PID 4884 wrote to memory of 3444 4884 rundll32.exe 82 PID 4884 wrote to memory of 3444 4884 rundll32.exe 82 PID 3444 wrote to memory of 804 3444 rundll32.exe 83 PID 3444 wrote to memory of 804 3444 rundll32.exe 83 PID 3444 wrote to memory of 804 3444 rundll32.exe 83 PID 804 wrote to memory of 764 804 e5779a4.exe 8 PID 804 wrote to memory of 772 804 e5779a4.exe 9 PID 804 wrote to memory of 64 804 e5779a4.exe 13 PID 804 wrote to memory of 2660 804 e5779a4.exe 44 PID 804 wrote to memory of 2684 804 e5779a4.exe 45 PID 804 wrote to memory of 2856 804 e5779a4.exe 50 PID 804 wrote to memory of 3408 804 e5779a4.exe 55 PID 804 wrote to memory of 3604 804 e5779a4.exe 57 PID 804 wrote to memory of 3792 804 e5779a4.exe 58 PID 804 wrote to memory of 3884 804 e5779a4.exe 59 PID 804 wrote to memory of 3948 804 e5779a4.exe 60 PID 804 wrote to memory of 4032 804 e5779a4.exe 61 PID 804 wrote to memory of 4140 804 e5779a4.exe 62 PID 804 wrote to memory of 4640 804 e5779a4.exe 74 PID 804 wrote to memory of 912 804 e5779a4.exe 76 PID 804 wrote to memory of 4884 804 e5779a4.exe 81 PID 804 wrote to memory of 3444 804 e5779a4.exe 82 PID 804 wrote to memory of 3444 804 e5779a4.exe 82 PID 3444 wrote to memory of 3336 3444 rundll32.exe 84 PID 3444 wrote to memory of 3336 3444 rundll32.exe 84 PID 3444 wrote to memory of 3336 3444 rundll32.exe 84 PID 3444 wrote to memory of 2112 3444 rundll32.exe 85 PID 3444 wrote to memory of 2112 3444 rundll32.exe 85 PID 3444 wrote to memory of 2112 3444 rundll32.exe 85 PID 3444 wrote to memory of 2912 3444 rundll32.exe 86 PID 3444 wrote to memory of 2912 3444 rundll32.exe 86 PID 3444 wrote to memory of 2912 3444 rundll32.exe 86 PID 804 wrote to memory of 764 804 e5779a4.exe 8 PID 804 wrote to memory of 772 804 e5779a4.exe 9 PID 804 wrote to memory of 64 804 e5779a4.exe 13 PID 804 wrote to memory of 2660 804 e5779a4.exe 44 PID 804 wrote to memory of 2684 804 e5779a4.exe 45 PID 804 wrote to memory of 2856 804 e5779a4.exe 50 PID 804 wrote to memory of 3408 804 e5779a4.exe 55 PID 804 wrote to memory of 3604 804 e5779a4.exe 57 PID 804 wrote to memory of 3792 804 e5779a4.exe 58 PID 804 wrote to memory of 3884 804 e5779a4.exe 59 PID 804 wrote to memory of 3948 804 e5779a4.exe 60 PID 804 wrote to memory of 4032 804 e5779a4.exe 61 PID 804 wrote to memory of 4140 804 e5779a4.exe 62 PID 804 wrote to memory of 4640 804 e5779a4.exe 74 PID 804 wrote to memory of 912 804 e5779a4.exe 76 PID 804 wrote to memory of 3336 804 e5779a4.exe 84 PID 804 wrote to memory of 3336 804 e5779a4.exe 84 PID 804 wrote to memory of 2112 804 e5779a4.exe 85 PID 804 wrote to memory of 2112 804 e5779a4.exe 85 PID 804 wrote to memory of 2912 804 e5779a4.exe 86 PID 804 wrote to memory of 2912 804 e5779a4.exe 86 PID 2912 wrote to memory of 764 2912 e57953b.exe 8 PID 2912 wrote to memory of 772 2912 e57953b.exe 9 PID 2912 wrote to memory of 64 2912 e57953b.exe 13 PID 2912 wrote to memory of 2660 2912 e57953b.exe 44 PID 2912 wrote to memory of 2684 2912 e57953b.exe 45 PID 2912 wrote to memory of 2856 2912 e57953b.exe 50 PID 2912 wrote to memory of 3408 2912 e57953b.exe 55 PID 2912 wrote to memory of 3604 2912 e57953b.exe 57 PID 2912 wrote to memory of 3792 2912 e57953b.exe 58 PID 2912 wrote to memory of 3884 2912 e57953b.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5779a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57953b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2684
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2856
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de7e77a3ff2cf4897177c46aa284f50644671e58d0e1793b487854dd34e60757N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de7e77a3ff2cf4897177c46aa284f50644671e58d0e1793b487854dd34e60757N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\e5779a4.exeC:\Users\Admin\AppData\Local\Temp\e5779a4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:804
-
-
C:\Users\Admin\AppData\Local\Temp\e577abe.exeC:\Users\Admin\AppData\Local\Temp\e577abe.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3336
-
-
C:\Users\Admin\AppData\Local\Temp\e57952b.exeC:\Users\Admin\AppData\Local\Temp\e57952b.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\e57953b.exeC:\Users\Admin\AppData\Local\Temp\e57953b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2912
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3792
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3948
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4032
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4140
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4640
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:912
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5090deaa37bd724848c4636649abd2a8f
SHA17209509d49b61efdd0593be3b1c47f137e096ca8
SHA256c3bd11a8cbef20fc8e51cc04c07b827d621a8a87d459787a09fa07f578074758
SHA512f562d36cdb99c27be846eaaf080376febea442ad3ea46e0056a9ac5fbea1de8e2ca08cf31372c2bc193c97626d803324f1b0b301b5a0da6de93e7d3aaa8ca362
-
Filesize
257B
MD512b456300920a3d05bd98a88d51e62da
SHA1f39c6ada98155f57dba1b949852bf1bc567395e6
SHA2567ac169622385867688ed9a7787d5bb0822dc488916a2f1e12e5324e3652c4bc2
SHA51202b38546e8f7c4c66ce0a109e2288bd96da6123d50f815c457b1411964fa285dbc023df26eab79eaf736737c16690be204420b7fcac9bd40a7d63142bd678d5c