Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 20:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
384d041a8f5e99096dfb3b2b70ffe60af816e1ad97e0078015c0bb98c210ee06.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
384d041a8f5e99096dfb3b2b70ffe60af816e1ad97e0078015c0bb98c210ee06.dll
-
Size
120KB
-
MD5
8a84216e35fdae131363fc35d234481b
-
SHA1
d48a7f60350db0afbb6322fe8981dc360794766a
-
SHA256
384d041a8f5e99096dfb3b2b70ffe60af816e1ad97e0078015c0bb98c210ee06
-
SHA512
d57b587e6ce6649bd7c45e7e70eaa4a88275c9d837428f1d59430a003c60fcccf30d1866b0cff0eec4e6f8d5000b37942a3f87e5c6b3fb508fd9fe47d5d1b9b9
-
SSDEEP
3072:Wo6PYLJo1zXuE2KUphJ8abTX3wPph149ldJZg:ngf1Dcpca/UhGfJZg
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579e92.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579fab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579fab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579e92.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b9ea.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b9ea.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579fab.exe -
Executes dropped EXE 4 IoCs
pid Process 4544 e579e92.exe 4132 e579fab.exe 4916 e57b9ca.exe 4460 e57b9ea.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b9ea.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579e92.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579fab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b9ea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b9ea.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b9ea.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e579e92.exe File opened (read-only) \??\H: e579e92.exe File opened (read-only) \??\L: e579e92.exe File opened (read-only) \??\M: e579e92.exe File opened (read-only) \??\O: e579e92.exe File opened (read-only) \??\R: e579e92.exe File opened (read-only) \??\I: e579e92.exe File opened (read-only) \??\J: e579e92.exe File opened (read-only) \??\N: e579e92.exe File opened (read-only) \??\P: e579e92.exe File opened (read-only) \??\Q: e579e92.exe File opened (read-only) \??\S: e579e92.exe File opened (read-only) \??\G: e579e92.exe File opened (read-only) \??\K: e579e92.exe -
resource yara_rule behavioral2/memory/4544-6-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-8-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-12-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-9-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-26-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-31-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-30-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-33-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-25-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-11-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-10-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-36-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-35-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-37-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-39-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-38-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-41-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-42-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-54-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-60-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-61-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-75-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-77-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-80-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-82-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-83-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-85-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-86-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-88-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-90-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-93-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4544-96-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4132-130-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/4132-144-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e579e92.exe File opened for modification C:\Program Files\7-Zip\7z.exe e579e92.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e579e92.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e579e92.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e580877 e57b9ea.exe File created C:\Windows\e579f1e e579e92.exe File opened for modification C:\Windows\SYSTEM.INI e579e92.exe File created C:\Windows\e57efee e579fab.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b9ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579e92.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579fab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b9ca.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4544 e579e92.exe 4544 e579e92.exe 4544 e579e92.exe 4544 e579e92.exe 4132 e579fab.exe 4132 e579fab.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe Token: SeDebugPrivilege 4544 e579e92.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 4632 wrote to memory of 4116 4632 rundll32.exe 83 PID 4632 wrote to memory of 4116 4632 rundll32.exe 83 PID 4632 wrote to memory of 4116 4632 rundll32.exe 83 PID 4116 wrote to memory of 4544 4116 rundll32.exe 84 PID 4116 wrote to memory of 4544 4116 rundll32.exe 84 PID 4116 wrote to memory of 4544 4116 rundll32.exe 84 PID 4544 wrote to memory of 760 4544 e579e92.exe 8 PID 4544 wrote to memory of 764 4544 e579e92.exe 9 PID 4544 wrote to memory of 64 4544 e579e92.exe 13 PID 4544 wrote to memory of 3048 4544 e579e92.exe 51 PID 4544 wrote to memory of 2624 4544 e579e92.exe 52 PID 4544 wrote to memory of 3100 4544 e579e92.exe 53 PID 4544 wrote to memory of 3472 4544 e579e92.exe 56 PID 4544 wrote to memory of 3588 4544 e579e92.exe 57 PID 4544 wrote to memory of 3792 4544 e579e92.exe 58 PID 4544 wrote to memory of 3884 4544 e579e92.exe 59 PID 4544 wrote to memory of 3956 4544 e579e92.exe 60 PID 4544 wrote to memory of 4052 4544 e579e92.exe 61 PID 4544 wrote to memory of 4212 4544 e579e92.exe 62 PID 4544 wrote to memory of 4732 4544 e579e92.exe 75 PID 4544 wrote to memory of 3744 4544 e579e92.exe 76 PID 4544 wrote to memory of 3808 4544 e579e92.exe 81 PID 4544 wrote to memory of 4632 4544 e579e92.exe 82 PID 4544 wrote to memory of 4116 4544 e579e92.exe 83 PID 4544 wrote to memory of 4116 4544 e579e92.exe 83 PID 4116 wrote to memory of 4132 4116 rundll32.exe 85 PID 4116 wrote to memory of 4132 4116 rundll32.exe 85 PID 4116 wrote to memory of 4132 4116 rundll32.exe 85 PID 4116 wrote to memory of 4916 4116 rundll32.exe 87 PID 4116 wrote to memory of 4916 4116 rundll32.exe 87 PID 4116 wrote to memory of 4916 4116 rundll32.exe 87 PID 4116 wrote to memory of 4460 4116 rundll32.exe 88 PID 4116 wrote to memory of 4460 4116 rundll32.exe 88 PID 4116 wrote to memory of 4460 4116 rundll32.exe 88 PID 4544 wrote to memory of 760 4544 e579e92.exe 8 PID 4544 wrote to memory of 764 4544 e579e92.exe 9 PID 4544 wrote to memory of 64 4544 e579e92.exe 13 PID 4544 wrote to memory of 3048 4544 e579e92.exe 51 PID 4544 wrote to memory of 2624 4544 e579e92.exe 52 PID 4544 wrote to memory of 3100 4544 e579e92.exe 53 PID 4544 wrote to memory of 3472 4544 e579e92.exe 56 PID 4544 wrote to memory of 3588 4544 e579e92.exe 57 PID 4544 wrote to memory of 3792 4544 e579e92.exe 58 PID 4544 wrote to memory of 3884 4544 e579e92.exe 59 PID 4544 wrote to memory of 3956 4544 e579e92.exe 60 PID 4544 wrote to memory of 4052 4544 e579e92.exe 61 PID 4544 wrote to memory of 4212 4544 e579e92.exe 62 PID 4544 wrote to memory of 4732 4544 e579e92.exe 75 PID 4544 wrote to memory of 3744 4544 e579e92.exe 76 PID 4544 wrote to memory of 4132 4544 e579e92.exe 85 PID 4544 wrote to memory of 4132 4544 e579e92.exe 85 PID 4544 wrote to memory of 4916 4544 e579e92.exe 87 PID 4544 wrote to memory of 4916 4544 e579e92.exe 87 PID 4544 wrote to memory of 4460 4544 e579e92.exe 88 PID 4544 wrote to memory of 4460 4544 e579e92.exe 88 PID 4132 wrote to memory of 760 4132 e579fab.exe 8 PID 4132 wrote to memory of 764 4132 e579fab.exe 9 PID 4132 wrote to memory of 64 4132 e579fab.exe 13 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579e92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579fab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b9ea.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2624
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3100
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\384d041a8f5e99096dfb3b2b70ffe60af816e1ad97e0078015c0bb98c210ee06.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\384d041a8f5e99096dfb3b2b70ffe60af816e1ad97e0078015c0bb98c210ee06.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\e579e92.exeC:\Users\Admin\AppData\Local\Temp\e579e92.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4544
-
-
C:\Users\Admin\AppData\Local\Temp\e579fab.exeC:\Users\Admin\AppData\Local\Temp\e579fab.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4132
-
-
C:\Users\Admin\AppData\Local\Temp\e57b9ca.exeC:\Users\Admin\AppData\Local\Temp\e57b9ca.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\e57b9ea.exeC:\Users\Admin\AppData\Local\Temp\e57b9ea.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:4460
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3792
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3956
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4052
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4212
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4732
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3744
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3808
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD58e5d98346038cdf17545ab4a6b386cab
SHA189f65b2f38b9abeef28dcec1ec7f8301aefd0943
SHA2566daa0a80b90488c6281d7be6fe70f5a40d659adda6ac72f60681333b90b605b3
SHA512a9efa723affc12103ae7e3dd901c064458274e9fa7320933fa548c7ceb2a9bbb57abbe24c16b1623f33ea46f31e77608d22836fc8f01563b205c8e3ebc5d4732
-
Filesize
257B
MD54a998e201f3d42bdb58ccd77c3739f16
SHA15b7c297a14947b3f50769e0c7b305f4e35e28ebd
SHA256928c5784f4b2a868290f554cb4ea6901fd6f9bee79da493cc3d43fd316b7e8e3
SHA512025c258fdba15e26a4d500c1a1a5e1acd128d0d926d220e709b9c1281c53e05ddeeaa6d7d3c5e08005e40347bcb34d33855a00474cb9898d0d91841ed10c56ed