Analysis
-
max time kernel
32s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04005dd1eee254aaa893ac325852a306b26175dd0772b0e46a4b69327514d1efN.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
04005dd1eee254aaa893ac325852a306b26175dd0772b0e46a4b69327514d1efN.dll
-
Size
120KB
-
MD5
1b056da8def36eb3af393fe88e789410
-
SHA1
df6f82ff17d8413f8c07564ba40db7ade7ede1fe
-
SHA256
04005dd1eee254aaa893ac325852a306b26175dd0772b0e46a4b69327514d1ef
-
SHA512
b48c4b8b842de3228ac471c26559b543c7b066aab72c6dfd79b5e43d97ccfa9858f8dce1dd87ce5460d82bcc916637005b9e69590ad0c2b656a21462cdd872ac
-
SSDEEP
1536:Br/mAVUTSZTa5KANWMS6/s2/lQ52D+fuwfLIHulCroZTMOWysHFFmjaM3:BTbmYiWT6/pG8OwUZTMOWyokaM3
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d27b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ba3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d27b.exe -
Executes dropped EXE 3 IoCs
pid Process 2484 f769ba3.exe 1880 f769dc5.exe 1988 f76d27b.exe -
Loads dropped DLL 6 IoCs
pid Process 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ba3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769dc5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d27b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d27b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d27b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ba3.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f76d27b.exe File opened (read-only) \??\P: f769ba3.exe File opened (read-only) \??\S: f769ba3.exe File opened (read-only) \??\K: f769ba3.exe File opened (read-only) \??\R: f769ba3.exe File opened (read-only) \??\G: f769ba3.exe File opened (read-only) \??\J: f769ba3.exe File opened (read-only) \??\N: f769ba3.exe File opened (read-only) \??\Q: f769ba3.exe File opened (read-only) \??\G: f76d27b.exe File opened (read-only) \??\H: f769ba3.exe File opened (read-only) \??\L: f769ba3.exe File opened (read-only) \??\M: f769ba3.exe File opened (read-only) \??\O: f769ba3.exe File opened (read-only) \??\T: f769ba3.exe File opened (read-only) \??\E: f76d27b.exe File opened (read-only) \??\E: f769ba3.exe File opened (read-only) \??\I: f769ba3.exe -
resource yara_rule behavioral1/memory/2484-21-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-18-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-16-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-24-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-22-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-20-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-25-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-23-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-17-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-19-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-63-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-64-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-65-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-66-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-67-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-69-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-70-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-71-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-72-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-74-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-76-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-91-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-92-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-95-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-96-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2484-146-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1880-150-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/1880-191-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f769c30 f769ba3.exe File opened for modification C:\Windows\SYSTEM.INI f769ba3.exe File created C:\Windows\f76ec71 f769dc5.exe File created C:\Windows\f76f9ba f76d27b.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769ba3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769dc5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d27b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2484 f769ba3.exe 2484 f769ba3.exe 1880 f769dc5.exe 1988 f76d27b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 2484 f769ba3.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1880 f769dc5.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe Token: SeDebugPrivilege 1988 f76d27b.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2484 wrote to memory of 1096 2484 f769ba3.exe 19 PID 2484 wrote to memory of 1176 2484 f769ba3.exe 20 PID 2484 wrote to memory of 1204 2484 f769ba3.exe 21 PID 2484 wrote to memory of 884 2484 f769ba3.exe 25 PID 2484 wrote to memory of 2684 2484 f769ba3.exe 29 PID 2484 wrote to memory of 2680 2484 f769ba3.exe 30 PID 2484 wrote to memory of 2680 2484 f769ba3.exe 30 PID 2680 wrote to memory of 1880 2680 rundll32.exe 32 PID 2680 wrote to memory of 1880 2680 rundll32.exe 32 PID 2680 wrote to memory of 1880 2680 rundll32.exe 32 PID 2680 wrote to memory of 1880 2680 rundll32.exe 32 PID 2484 wrote to memory of 1096 2484 f769ba3.exe 19 PID 2484 wrote to memory of 1176 2484 f769ba3.exe 20 PID 2484 wrote to memory of 1204 2484 f769ba3.exe 21 PID 2484 wrote to memory of 884 2484 f769ba3.exe 25 PID 2484 wrote to memory of 2684 2484 f769ba3.exe 29 PID 2484 wrote to memory of 1880 2484 f769ba3.exe 32 PID 2484 wrote to memory of 1880 2484 f769ba3.exe 32 PID 2680 wrote to memory of 1988 2680 rundll32.exe 34 PID 2680 wrote to memory of 1988 2680 rundll32.exe 34 PID 2680 wrote to memory of 1988 2680 rundll32.exe 34 PID 2680 wrote to memory of 1988 2680 rundll32.exe 34 PID 1880 wrote to memory of 1096 1880 f769dc5.exe 19 PID 1880 wrote to memory of 1176 1880 f769dc5.exe 20 PID 1880 wrote to memory of 1204 1880 f769dc5.exe 21 PID 1880 wrote to memory of 884 1880 f769dc5.exe 25 PID 1880 wrote to memory of 1988 1880 f769dc5.exe 34 PID 1880 wrote to memory of 1988 1880 f769dc5.exe 34 PID 1988 wrote to memory of 1096 1988 f76d27b.exe 19 PID 1988 wrote to memory of 1176 1988 f76d27b.exe 20 PID 1988 wrote to memory of 1204 1988 f76d27b.exe 21 PID 1988 wrote to memory of 884 1988 f76d27b.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ba3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769dc5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d27b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04005dd1eee254aaa893ac325852a306b26175dd0772b0e46a4b69327514d1efN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04005dd1eee254aaa893ac325852a306b26175dd0772b0e46a4b69327514d1efN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\f769ba3.exeC:\Users\Admin\AppData\Local\Temp\f769ba3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\f769dc5.exeC:\Users\Admin\AppData\Local\Temp\f769dc5.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1880
-
-
C:\Users\Admin\AppData\Local\Temp\f76d27b.exeC:\Users\Admin\AppData\Local\Temp\f76d27b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1988
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD51de18ed309bd67d92757b4f2d5a70d10
SHA11910b227f0378852b580c52557e3142a5cd93dc0
SHA256f1f221a758dbe03f657f164540f3cbfbf195f7edcc6e37523ee3292a8847361e
SHA512794968749256375f6287ff31e66e32f7fe87559215b3f20340b3af81ec34e744c0598e964f3a817e6b98bd320aa1d34e4c8653b8ba467c3a982e76151a4ff679
-
Filesize
97KB
MD59db15f09491a8452e3ec278643436934
SHA1b6f29f43f24301195aa0872e84e9857f319553d3
SHA256679bd05af678e6257e79d565f93c376fff49e2ce5d46e917bf54eab5bd3ea9dd
SHA5127fc80e43545fe67047c81c9cfd23c9a29a48d4e84d3911eef1ca847df6f73a7178d2089527e1555360164e79d5f0f212939def07049119634d81428e3b1ebcb7