Analysis
-
max time kernel
38s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 22:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe
Resource
win7-20241010-en
windows7-x64
18 signatures
150 seconds
General
-
Target
4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe
-
Size
741KB
-
MD5
ba76d31811905e1e6e2324a63eb1c48a
-
SHA1
75a4db325f059b4055c9f827512e9a4a2171ff7b
-
SHA256
4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0
-
SHA512
d57a8af51d5802f8b8dbe254fdc84009200644272eb9d40fccf4c5e5952eb19126ff479ba4aa3d47c32846006a143f3b786ec25045122ce409055b56c6df7e43
-
SSDEEP
12288:67BJqMcE8BVip7GWcLxL2KN6YoPatd1zHm8+LrEoMzfxmgGF:678n47Vc7ZRdJm8TxzfcH
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" CacheMgr.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe -
Executes dropped EXE 1 IoCs
pid Process 4972 CacheMgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: CacheMgr.exe File opened (read-only) \??\G: CacheMgr.exe File opened (read-only) \??\H: CacheMgr.exe -
resource yara_rule behavioral2/memory/748-6-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-4-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-10-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-9-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-16-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-18-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-17-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-8-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-7-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-19-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-32-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-33-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/748-44-0x0000000000A90000-0x0000000001B4A000-memory.dmp upx behavioral2/memory/4972-60-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-65-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-64-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-61-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-59-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-62-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-58-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-56-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-63-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-73-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-76-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-75-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-77-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-78-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-79-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-81-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-82-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-83-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-84-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-86-0x0000000002740000-0x00000000037FA000-memory.dmp upx behavioral2/memory/4972-88-0x0000000002740000-0x00000000037FA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57c9c8 CacheMgr.exe File created C:\Windows\e577e38 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe File opened for modification C:\Windows\SYSTEM.INI 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CacheMgr.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 4972 CacheMgr.exe 4972 CacheMgr.exe 4972 CacheMgr.exe 4972 CacheMgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Token: SeDebugPrivilege 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 748 wrote to memory of 3052 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 82 PID 748 wrote to memory of 3052 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 82 PID 748 wrote to memory of 3052 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 82 PID 748 wrote to memory of 768 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 8 PID 748 wrote to memory of 772 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 9 PID 748 wrote to memory of 384 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 13 PID 748 wrote to memory of 2992 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 51 PID 748 wrote to memory of 3040 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 52 PID 748 wrote to memory of 684 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 53 PID 748 wrote to memory of 3424 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 56 PID 748 wrote to memory of 3532 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 57 PID 748 wrote to memory of 3720 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 58 PID 748 wrote to memory of 3808 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 59 PID 748 wrote to memory of 3872 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 60 PID 748 wrote to memory of 3948 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 61 PID 748 wrote to memory of 3444 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 62 PID 748 wrote to memory of 2604 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 75 PID 748 wrote to memory of 1580 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 76 PID 748 wrote to memory of 3052 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 82 PID 748 wrote to memory of 3052 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 82 PID 748 wrote to memory of 4972 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 84 PID 748 wrote to memory of 4972 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 84 PID 748 wrote to memory of 4972 748 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe 84 PID 4972 wrote to memory of 768 4972 CacheMgr.exe 8 PID 4972 wrote to memory of 772 4972 CacheMgr.exe 9 PID 4972 wrote to memory of 384 4972 CacheMgr.exe 13 PID 4972 wrote to memory of 2992 4972 CacheMgr.exe 51 PID 4972 wrote to memory of 3040 4972 CacheMgr.exe 52 PID 4972 wrote to memory of 684 4972 CacheMgr.exe 53 PID 4972 wrote to memory of 3424 4972 CacheMgr.exe 56 PID 4972 wrote to memory of 3532 4972 CacheMgr.exe 57 PID 4972 wrote to memory of 3720 4972 CacheMgr.exe 58 PID 4972 wrote to memory of 3808 4972 CacheMgr.exe 59 PID 4972 wrote to memory of 3872 4972 CacheMgr.exe 60 PID 4972 wrote to memory of 3948 4972 CacheMgr.exe 61 PID 4972 wrote to memory of 3444 4972 CacheMgr.exe 62 PID 4972 wrote to memory of 2604 4972 CacheMgr.exe 75 PID 4972 wrote to memory of 1580 4972 CacheMgr.exe 76 PID 4972 wrote to memory of 768 4972 CacheMgr.exe 8 PID 4972 wrote to memory of 772 4972 CacheMgr.exe 9 PID 4972 wrote to memory of 384 4972 CacheMgr.exe 13 PID 4972 wrote to memory of 2992 4972 CacheMgr.exe 51 PID 4972 wrote to memory of 3040 4972 CacheMgr.exe 52 PID 4972 wrote to memory of 684 4972 CacheMgr.exe 53 PID 4972 wrote to memory of 3424 4972 CacheMgr.exe 56 PID 4972 wrote to memory of 3532 4972 CacheMgr.exe 57 PID 4972 wrote to memory of 3720 4972 CacheMgr.exe 58 PID 4972 wrote to memory of 3808 4972 CacheMgr.exe 59 PID 4972 wrote to memory of 3872 4972 CacheMgr.exe 60 PID 4972 wrote to memory of 3948 4972 CacheMgr.exe 61 PID 4972 wrote to memory of 3444 4972 CacheMgr.exe 62 PID 4972 wrote to memory of 2604 4972 CacheMgr.exe 75 PID 4972 wrote to memory of 1580 4972 CacheMgr.exe 76 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3040
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe"C:\Users\Admin\AppData\Local\Temp\4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\4dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0.exe" "C:\ProgramData\CacheMgr.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3052
-
-
C:\ProgramData\CacheMgr.exe"C:\ProgramData\CacheMgr.exe" -as3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4972
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3532
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3720
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3808
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3872
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3444
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2604
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741KB
MD5ba76d31811905e1e6e2324a63eb1c48a
SHA175a4db325f059b4055c9f827512e9a4a2171ff7b
SHA2564dfd4bb7acf5cf1dd77e703956f89fa31142acd4e72d31891b3555a094594ce0
SHA512d57a8af51d5802f8b8dbe254fdc84009200644272eb9d40fccf4c5e5952eb19126ff479ba4aa3d47c32846006a143f3b786ec25045122ce409055b56c6df7e43
-
Filesize
257B
MD513c8e3024dbb925c341887e63bf98c6f
SHA15b6f73f9a3fba29fb15bf4d4f4350c44827d3865
SHA2568947a38bc3da0a207391ce53c2651e8dfec9172805ff69ca9faad79c4673f70a
SHA51220fe72eebb8c93f7fc2646cd1569a89e824d9de6c74fe70ea6275409c3bdfddd770a63b2411f1c588cb5299ca64fb6c88ecacee8bf9c836b9dc63c9f2da7df79
-
Filesize
97KB
MD5f481a066de217c8955ad35fe4c057206
SHA1e55340ea9ee4a425331f6f32d579b193eea28f91
SHA2562f306788a064aacbc2f0d563fdd025850e81d5b5d761fd50a80c0f7735a84467
SHA512397aa1b2242f611fb5cbf2b0cc19987a4f9f52483a2b0718f447925ce52fc99c69d02031dbf1c7d487f763a789c572fba1ceeab30eca5ebcb68ae2355513ac31