Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe
Resource
win7-20241010-en
windows7-x64
20 signatures
150 seconds
General
-
Target
7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe
-
Size
3.9MB
-
MD5
6791d78a1e416823fe4450d05ef9598e
-
SHA1
3d7842562b0e66cf88ab71a1fba7b482179bdc8c
-
SHA256
7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf
-
SHA512
49a7cee20aebe106a9cefd9a129ebe81380b0648d89549f8a0eb5819fe12371b0259a55caae879d5327057b8cfd5e086c724becf38ea5d2154b2ffa7e56af50a
-
SSDEEP
98304:F1D7IVKqo6eTEgiYhuBBYYXomgviswVWNniUlPmnMOAPv:bIVKn6g3huXb7sAWIkUMOsv
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Executes dropped EXE 1 IoCs
pid Process 2652 XW16Pro脱机烧录器远程客户端.exe -
Loads dropped DLL 4 IoCs
pid Process 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\R: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\W: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\Y: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\H: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\J: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\M: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\S: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\V: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\X: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\Z: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\E: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\G: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\I: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\L: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\P: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\O: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\Q: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\T: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened (read-only) \??\U: 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened for modification F:\autorun.inf 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
resource yara_rule behavioral1/memory/2052-8-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-5-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-9-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-3-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-14-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-12-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-6-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-7-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-4-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-16-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-69-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-72-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-71-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-57-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-56-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-76-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-77-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-79-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-80-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-84-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-85-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-112-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-114-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral1/memory/2052-117-0x0000000000770000-0x000000000182A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe File created C:\Windows\f76e495 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XW16Pro脱机烧录器远程客户端.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2652 XW16Pro脱机烧录器远程客户端.exe 2652 XW16Pro脱机烧录器远程客户端.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2652 XW16Pro脱机烧录器远程客户端.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2652 XW16Pro脱机烧录器远程客户端.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe Token: SeDebugPrivilege 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 2652 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 31 PID 2052 wrote to memory of 2652 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 31 PID 2052 wrote to memory of 2652 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 31 PID 2052 wrote to memory of 2652 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 31 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 2652 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 31 PID 2052 wrote to memory of 2652 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 31 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 PID 2052 wrote to memory of 1264 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 19 PID 2052 wrote to memory of 1348 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 20 PID 2052 wrote to memory of 1408 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 21 PID 2052 wrote to memory of 1708 2052 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1264
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1348
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe"C:\Users\Admin\AppData\Local\Temp\7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\XW16Pro脱机烧录器远程客户端.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\XW16Pro脱机烧录器远程客户端.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1708
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F76ED2C_Rar\7265321baae43182835066d9ab5a90a5efa1b7a0cb92f106f36429bf1e8371bf.exe
Filesize3.9MB
MD5c6058463577957e2c50a94720ca34707
SHA1c85e715fa73b6095bd472b5db9d2758751f82b0a
SHA256a72257bdfac70290f3189c75bec1038dd49158371bfdd0abcf02acaef6d38512
SHA5121d73cb782aa2e641d4c015d47ead0829ff51172b9deca7c22985f3478981d56fd725fa5407cd3777670e59a79426cb3bf51ec0c9e402ac624bcfcd06afc411a9
-
Filesize
1KB
MD515c71546d8a6718390320cb8042d90d8
SHA187381fac0849f13a298acd62db5a045512631e75
SHA25695358b6d18b9220683efd944b0274f18744d2c7a7210986b620f3b32dc01edcc
SHA512b8d840e3cf83568ceede8f01ea780775b9f0148119da7e9935a864bd7a9f9d4ddd0147d26f36748fb53eb5e2fe43f95766710f39bb9699c21c729edafa77b385
-
Filesize
44KB
MD576921f77785ae8652e71cf4dfe8ad3f2
SHA170527be3c156ecba2dbedef9b0a18136614a3cd2
SHA25648fc3d23f28c8e20244c6394508a6dfb10aca92de1e048637d2a2d7ecf264609
SHA512a061f18f2c5a40315f0a710868735c9f5c390456d1f2931c4da21a287e46b658ea5017d6a5e9c4237d0b9a3bc99d54d69a5527d8bedba481066d8ed47b53911e
-
Filesize
97KB
MD5ae57f6879cfb2af75e49cfe103cebf83
SHA19b51ccdcd037a9088b477a1b4b7d21a036b7a692
SHA25604140d15e7133565b74cba3f5e2a68e6a78e53cd74d812812787b5061b11514a
SHA512eb133136877a59bb56460f2c6bba662d37becdc45a682d5b15b410fe6f806ba1cfb148268664fb5aa547058751494a65f5d5633b947c24cae1d8da1b31cfb5ae
-
Filesize
3.4MB
MD54171d78edb20d86d7e083fe57a1bbe7f
SHA136ad3968a58c4fd08e3d4be3a5f2ee977af27990
SHA256acce2dfa6ce2ab67b5a278e2032127158f49dd3c211eda38d9623877029372f8
SHA512e1bb967edf56dee9f4071861e2e4d606de45904d2d1d4f9300481dd5544ca2155bf1668ab5e14227ee45b6e459afcfe1fffd2304d496f5164c907553d6c7fd38