Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/12/2024, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe
Resource
win7-20240903-en
General
-
Target
19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe
-
Size
736KB
-
MD5
597655d6a160b5f6603a0e740b070b20
-
SHA1
2ee8d116ae2dbff6d48a56f543eb210fe422a62d
-
SHA256
19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821
-
SHA512
67d8742121967c63525239cc7c19ed979b37c0117971286e2d2fdd37f3f251fe9835d2211a44832a3e84b4c16ff43ae0d8581ec533d7908d229c3602824163d5
-
SSDEEP
12288:BTyjXW+48qWywrU4kGFezOAVuJ5PIFww7F5DO3HYffPtS35CwPxY:lIXW/8yw1ez54lIlF5SXYHPtkUwPy
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 844 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\G: rundll32.exe -
resource yara_rule behavioral2/memory/4348-3-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-5-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-6-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-18-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-21-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-13-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-7-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-14-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-4-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-1-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-24-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-25-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-26-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-29-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/4348-36-0x0000000002ED0000-0x0000000003F8A000-memory.dmp upx behavioral2/memory/844-52-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-59-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-58-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-57-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-62-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-61-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-60-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-54-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-55-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-56-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-72-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-73-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-74-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-75-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-76-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-78-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-79-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-80-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-81-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-83-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-86-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-88-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-90-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx behavioral2/memory/844-92-0x0000000004EF0000-0x0000000005FAA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e579ccc 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe File opened for modification C:\Windows\SYSTEM.INI 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe File created C:\Windows\e57cf46 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 844 rundll32.exe 844 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Token: SeDebugPrivilege 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 844 rundll32.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4348 wrote to memory of 796 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 8 PID 4348 wrote to memory of 804 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 9 PID 4348 wrote to memory of 376 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 13 PID 4348 wrote to memory of 2552 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 42 PID 4348 wrote to memory of 2580 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 43 PID 4348 wrote to memory of 2660 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 45 PID 4348 wrote to memory of 3452 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 56 PID 4348 wrote to memory of 3620 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 57 PID 4348 wrote to memory of 3836 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 58 PID 4348 wrote to memory of 3928 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 59 PID 4348 wrote to memory of 3992 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 60 PID 4348 wrote to memory of 4088 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 61 PID 4348 wrote to memory of 3676 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 62 PID 4348 wrote to memory of 1744 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 75 PID 4348 wrote to memory of 212 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 76 PID 4348 wrote to memory of 844 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 82 PID 4348 wrote to memory of 844 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 82 PID 4348 wrote to memory of 844 4348 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe 82 PID 844 wrote to memory of 796 844 rundll32.exe 8 PID 844 wrote to memory of 804 844 rundll32.exe 9 PID 844 wrote to memory of 376 844 rundll32.exe 13 PID 844 wrote to memory of 2552 844 rundll32.exe 42 PID 844 wrote to memory of 2580 844 rundll32.exe 43 PID 844 wrote to memory of 2660 844 rundll32.exe 45 PID 844 wrote to memory of 3452 844 rundll32.exe 56 PID 844 wrote to memory of 3620 844 rundll32.exe 57 PID 844 wrote to memory of 3836 844 rundll32.exe 58 PID 844 wrote to memory of 3928 844 rundll32.exe 59 PID 844 wrote to memory of 3992 844 rundll32.exe 60 PID 844 wrote to memory of 4088 844 rundll32.exe 61 PID 844 wrote to memory of 3676 844 rundll32.exe 62 PID 844 wrote to memory of 1744 844 rundll32.exe 75 PID 844 wrote to memory of 212 844 rundll32.exe 76 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2580
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2660
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe"C:\Users\Admin\AppData\Local\Temp\19f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821N.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4348 -
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:844
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3620
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4088
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3676
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1744
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:212
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
Filesize
736KB
MD5597655d6a160b5f6603a0e740b070b20
SHA12ee8d116ae2dbff6d48a56f543eb210fe422a62d
SHA25619f6fef109a8e4b1249bcb20ec7bcf7f84d880d3b711d85cd5b91a1862a84821
SHA51267d8742121967c63525239cc7c19ed979b37c0117971286e2d2fdd37f3f251fe9835d2211a44832a3e84b4c16ff43ae0d8581ec533d7908d229c3602824163d5
-
Filesize
257B
MD5f052d89b6fe2b14fc4bdf78919302bd8
SHA1afce81863b89a317f07a5bb98c97a8d2cc1ab0bb
SHA25661dc0808b41f250759ba2ed54cadf27befc01ca67849c94986497496d5cbb93f
SHA512b6d9c2fa7d64ef434489674b51e9fc0d87b0d50c3851f8f1ba78dd1da96b940a12ce5e41a4b783e5534ffa66a134d99cced00aa43da91149597292051a7d7d30
-
Filesize
97KB
MD5188f9c16f1e844c0da4b92227eb5ae62
SHA1a917c38320316c352d1ae22f2a187283e01d29de
SHA256f19628547574c91ef399227f9bc65468482eb1f8c3ea19eaf728cc231a8f9400
SHA512cde75789a389b200bee2a26876705c03ef5edfb84e902547a2174b72f664500954543de3f31885f5dec7fa6ef9cb2134079171ff8394afe7064845fffeb9f5c8