Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 23:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e92bfd904a035eb87816b93ae093c317a920423a6cb8a9973797b37128af63deN.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
e92bfd904a035eb87816b93ae093c317a920423a6cb8a9973797b37128af63deN.dll
-
Size
120KB
-
MD5
ac1deaeaf1a7097a40f77148008e3b30
-
SHA1
9eb08441ce493a099f4ea41f067178c79d490b33
-
SHA256
e92bfd904a035eb87816b93ae093c317a920423a6cb8a9973797b37128af63de
-
SHA512
a79469fe6927097ab052232c30c7376337e5f1d89b7b9f391dbdf0ea92989dba81539aa9ee8cbcef66653030dfcf06a537816011642b541add9ceb9aa74d6595
-
SSDEEP
1536:Toe7WY6FtLYMbhy4cCm59+NHIAy/zIC52cfl9V6dcvFezRq1Ktg/mm2gv:TX7cFs4iV2SllQzM1Ktg/i
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579952.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579952.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b4e8.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b4e8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b4e8.exe -
Executes dropped EXE 4 IoCs
pid Process 4560 e579952.exe 4800 e579ab9.exe 3728 e57b4c9.exe 232 e57b4e8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b4e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b4e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b4e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579952.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b4e8.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e579952.exe File opened (read-only) \??\I: e579952.exe File opened (read-only) \??\L: e579952.exe File opened (read-only) \??\M: e579952.exe File opened (read-only) \??\G: e57b4e8.exe File opened (read-only) \??\O: e579952.exe File opened (read-only) \??\P: e579952.exe File opened (read-only) \??\R: e579952.exe File opened (read-only) \??\T: e579952.exe File opened (read-only) \??\E: e579952.exe File opened (read-only) \??\H: e579952.exe File opened (read-only) \??\J: e579952.exe File opened (read-only) \??\K: e579952.exe File opened (read-only) \??\N: e579952.exe File opened (read-only) \??\S: e579952.exe File opened (read-only) \??\E: e57b4e8.exe File opened (read-only) \??\Q: e579952.exe -
resource yara_rule behavioral2/memory/4560-6-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-10-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-8-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-9-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-26-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-31-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-18-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-27-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-13-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-11-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-35-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-36-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-37-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-38-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-39-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-41-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-42-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-54-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-60-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-62-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-75-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-76-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-79-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-81-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-84-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-85-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-88-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-89-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-91-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-92-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-93-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4560-100-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/232-134-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/232-169-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe e579952.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e579952.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e579952.exe File opened for modification C:\Program Files\7-Zip\7z.exe e579952.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57e9f2 e57b4e8.exe File created C:\Windows\e5799ee e579952.exe File opened for modification C:\Windows\SYSTEM.INI e579952.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579952.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579ab9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b4c9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b4e8.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4560 e579952.exe 4560 e579952.exe 4560 e579952.exe 4560 e579952.exe 232 e57b4e8.exe 232 e57b4e8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe Token: SeDebugPrivilege 4560 e579952.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 5068 4736 rundll32.exe 82 PID 4736 wrote to memory of 5068 4736 rundll32.exe 82 PID 4736 wrote to memory of 5068 4736 rundll32.exe 82 PID 5068 wrote to memory of 4560 5068 rundll32.exe 83 PID 5068 wrote to memory of 4560 5068 rundll32.exe 83 PID 5068 wrote to memory of 4560 5068 rundll32.exe 83 PID 4560 wrote to memory of 768 4560 e579952.exe 8 PID 4560 wrote to memory of 772 4560 e579952.exe 9 PID 4560 wrote to memory of 384 4560 e579952.exe 13 PID 4560 wrote to memory of 2508 4560 e579952.exe 43 PID 4560 wrote to memory of 2544 4560 e579952.exe 44 PID 4560 wrote to memory of 2708 4560 e579952.exe 47 PID 4560 wrote to memory of 3484 4560 e579952.exe 56 PID 4560 wrote to memory of 3628 4560 e579952.exe 57 PID 4560 wrote to memory of 3824 4560 e579952.exe 58 PID 4560 wrote to memory of 3916 4560 e579952.exe 59 PID 4560 wrote to memory of 3980 4560 e579952.exe 60 PID 4560 wrote to memory of 4060 4560 e579952.exe 61 PID 4560 wrote to memory of 3012 4560 e579952.exe 62 PID 4560 wrote to memory of 1740 4560 e579952.exe 75 PID 4560 wrote to memory of 3552 4560 e579952.exe 76 PID 4560 wrote to memory of 4736 4560 e579952.exe 81 PID 4560 wrote to memory of 5068 4560 e579952.exe 82 PID 4560 wrote to memory of 5068 4560 e579952.exe 82 PID 5068 wrote to memory of 4800 5068 rundll32.exe 84 PID 5068 wrote to memory of 4800 5068 rundll32.exe 84 PID 5068 wrote to memory of 4800 5068 rundll32.exe 84 PID 5068 wrote to memory of 3728 5068 rundll32.exe 85 PID 5068 wrote to memory of 3728 5068 rundll32.exe 85 PID 5068 wrote to memory of 3728 5068 rundll32.exe 85 PID 5068 wrote to memory of 232 5068 rundll32.exe 86 PID 5068 wrote to memory of 232 5068 rundll32.exe 86 PID 5068 wrote to memory of 232 5068 rundll32.exe 86 PID 4560 wrote to memory of 768 4560 e579952.exe 8 PID 4560 wrote to memory of 772 4560 e579952.exe 9 PID 4560 wrote to memory of 384 4560 e579952.exe 13 PID 4560 wrote to memory of 2508 4560 e579952.exe 43 PID 4560 wrote to memory of 2544 4560 e579952.exe 44 PID 4560 wrote to memory of 2708 4560 e579952.exe 47 PID 4560 wrote to memory of 3484 4560 e579952.exe 56 PID 4560 wrote to memory of 3628 4560 e579952.exe 57 PID 4560 wrote to memory of 3824 4560 e579952.exe 58 PID 4560 wrote to memory of 3916 4560 e579952.exe 59 PID 4560 wrote to memory of 3980 4560 e579952.exe 60 PID 4560 wrote to memory of 4060 4560 e579952.exe 61 PID 4560 wrote to memory of 3012 4560 e579952.exe 62 PID 4560 wrote to memory of 1740 4560 e579952.exe 75 PID 4560 wrote to memory of 3552 4560 e579952.exe 76 PID 4560 wrote to memory of 4800 4560 e579952.exe 84 PID 4560 wrote to memory of 4800 4560 e579952.exe 84 PID 4560 wrote to memory of 3728 4560 e579952.exe 85 PID 4560 wrote to memory of 3728 4560 e579952.exe 85 PID 4560 wrote to memory of 232 4560 e579952.exe 86 PID 4560 wrote to memory of 232 4560 e579952.exe 86 PID 232 wrote to memory of 768 232 e57b4e8.exe 8 PID 232 wrote to memory of 772 232 e57b4e8.exe 9 PID 232 wrote to memory of 384 232 e57b4e8.exe 13 PID 232 wrote to memory of 2508 232 e57b4e8.exe 43 PID 232 wrote to memory of 2544 232 e57b4e8.exe 44 PID 232 wrote to memory of 2708 232 e57b4e8.exe 47 PID 232 wrote to memory of 3484 232 e57b4e8.exe 56 PID 232 wrote to memory of 3628 232 e57b4e8.exe 57 PID 232 wrote to memory of 3824 232 e57b4e8.exe 58 PID 232 wrote to memory of 3916 232 e57b4e8.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b4e8.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2544
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2708
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e92bfd904a035eb87816b93ae093c317a920423a6cb8a9973797b37128af63deN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e92bfd904a035eb87816b93ae093c317a920423a6cb8a9973797b37128af63deN.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\e579952.exeC:\Users\Admin\AppData\Local\Temp\e579952.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4560
-
-
C:\Users\Admin\AppData\Local\Temp\e579ab9.exeC:\Users\Admin\AppData\Local\Temp\e579ab9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4800
-
-
C:\Users\Admin\AppData\Local\Temp\e57b4c9.exeC:\Users\Admin\AppData\Local\Temp\e57b4c9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\e57b4e8.exeC:\Users\Admin\AppData\Local\Temp\e57b4e8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:232
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3916
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3980
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4060
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3012
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1740
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3552
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD538a13fc361bd47e64cf638b98261deed
SHA1739dd29b79c9a81a83d22bdf0b1dbffe17fc8929
SHA2563e38344155ee350e69b2bc8b670f73931b8b06395d915f2bbd173f776c8abbce
SHA5125518582ba551a14b6e0fca53436bbbc4635573412d103429b215fcdbf2cea287411cc48ba931e8e1d16e092956a373840e2ca4b0eb0f2ffedc74d5334985f278
-
Filesize
257B
MD5c87726c567f0fad79f4d685579c50b2f
SHA19713f6e042caba63d7851e475017c002629f041b
SHA2568127517377e93cf742daf9e996714fb735c6f8d81af5cdedc383ed98a29f8d82
SHA512b7584d6934b2ad47da282a3d2b84060078fe233ac6d73318123c8abff7fb2c89bcc08aeea1d1e61c1aee1cb40ad9645996900466f83ccec6585549fa4c3ba5d9