Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 00:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ee9abd2adedeade729a1766a01d1cf7ad4b934bdfeca5ff05b6ef4dedd82f4cN.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
120 seconds
General
-
Target
4ee9abd2adedeade729a1766a01d1cf7ad4b934bdfeca5ff05b6ef4dedd82f4cN.dll
-
Size
120KB
-
MD5
1aef5425d150567b4f6127470710a7f0
-
SHA1
92fed5d444318dd2be77db10357fdb6bb6c33527
-
SHA256
4ee9abd2adedeade729a1766a01d1cf7ad4b934bdfeca5ff05b6ef4dedd82f4c
-
SHA512
b8de5b1601b1e592411b1bef29dc12e121401876d02314539563063a6b29a934f437ab0ad3c5b57a5034d898f677a5d44376d3e6fd6b8ccb8057d6b7db276f71
-
SSDEEP
1536:DX8baENrvgSvzW+y1YUH3rmTG9qoBEMxbpUooP2C29Uj7dJRh0C6x8hpQ7j:DX8bxrvgz++Yi3Jx1Ui59U/psj
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57f201.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57f201.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f201.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c7d4.exe -
Executes dropped EXE 3 IoCs
pid Process 1704 e57c7d4.exe 3596 e57c98a.exe 2428 e57f201.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c7d4.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f201.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c7d4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f201.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c7d4.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57c7d4.exe File opened (read-only) \??\I: e57c7d4.exe File opened (read-only) \??\L: e57c7d4.exe File opened (read-only) \??\J: e57f201.exe File opened (read-only) \??\K: e57c7d4.exe File opened (read-only) \??\N: e57c7d4.exe File opened (read-only) \??\E: e57f201.exe File opened (read-only) \??\G: e57c7d4.exe File opened (read-only) \??\H: e57c7d4.exe File opened (read-only) \??\M: e57c7d4.exe File opened (read-only) \??\H: e57f201.exe File opened (read-only) \??\I: e57f201.exe File opened (read-only) \??\J: e57c7d4.exe File opened (read-only) \??\G: e57f201.exe -
resource yara_rule behavioral2/memory/1704-6-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-10-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-9-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-26-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-32-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-33-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-12-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-11-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-8-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-35-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-34-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-36-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-37-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-38-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-39-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-40-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-55-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-57-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-58-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-60-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-62-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-65-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-66-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-69-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1704-71-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/2428-108-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2428-127-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2428-151-0x0000000000760000-0x000000000181A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e57c7d4.exe File created C:\Windows\e5819bd e57f201.exe File created C:\Windows\e57c841 e57c7d4.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c98a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57f201.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c7d4.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1704 e57c7d4.exe 1704 e57c7d4.exe 1704 e57c7d4.exe 1704 e57c7d4.exe 2428 e57f201.exe 2428 e57f201.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe Token: SeDebugPrivilege 1704 e57c7d4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 4428 4420 rundll32.exe 83 PID 4420 wrote to memory of 4428 4420 rundll32.exe 83 PID 4420 wrote to memory of 4428 4420 rundll32.exe 83 PID 4428 wrote to memory of 1704 4428 rundll32.exe 84 PID 4428 wrote to memory of 1704 4428 rundll32.exe 84 PID 4428 wrote to memory of 1704 4428 rundll32.exe 84 PID 1704 wrote to memory of 788 1704 e57c7d4.exe 8 PID 1704 wrote to memory of 796 1704 e57c7d4.exe 9 PID 1704 wrote to memory of 332 1704 e57c7d4.exe 13 PID 1704 wrote to memory of 2700 1704 e57c7d4.exe 45 PID 1704 wrote to memory of 2788 1704 e57c7d4.exe 49 PID 1704 wrote to memory of 3060 1704 e57c7d4.exe 52 PID 1704 wrote to memory of 3420 1704 e57c7d4.exe 56 PID 1704 wrote to memory of 3540 1704 e57c7d4.exe 57 PID 1704 wrote to memory of 3716 1704 e57c7d4.exe 58 PID 1704 wrote to memory of 3804 1704 e57c7d4.exe 59 PID 1704 wrote to memory of 3900 1704 e57c7d4.exe 60 PID 1704 wrote to memory of 3984 1704 e57c7d4.exe 61 PID 1704 wrote to memory of 3884 1704 e57c7d4.exe 62 PID 1704 wrote to memory of 3180 1704 e57c7d4.exe 75 PID 1704 wrote to memory of 5044 1704 e57c7d4.exe 76 PID 1704 wrote to memory of 3940 1704 e57c7d4.exe 81 PID 1704 wrote to memory of 4420 1704 e57c7d4.exe 82 PID 1704 wrote to memory of 4428 1704 e57c7d4.exe 83 PID 1704 wrote to memory of 4428 1704 e57c7d4.exe 83 PID 4428 wrote to memory of 3596 4428 rundll32.exe 85 PID 4428 wrote to memory of 3596 4428 rundll32.exe 85 PID 4428 wrote to memory of 3596 4428 rundll32.exe 85 PID 1704 wrote to memory of 788 1704 e57c7d4.exe 8 PID 1704 wrote to memory of 796 1704 e57c7d4.exe 9 PID 1704 wrote to memory of 332 1704 e57c7d4.exe 13 PID 1704 wrote to memory of 2700 1704 e57c7d4.exe 45 PID 1704 wrote to memory of 2788 1704 e57c7d4.exe 49 PID 1704 wrote to memory of 3060 1704 e57c7d4.exe 52 PID 1704 wrote to memory of 3420 1704 e57c7d4.exe 56 PID 1704 wrote to memory of 3540 1704 e57c7d4.exe 57 PID 1704 wrote to memory of 3716 1704 e57c7d4.exe 58 PID 1704 wrote to memory of 3804 1704 e57c7d4.exe 59 PID 1704 wrote to memory of 3900 1704 e57c7d4.exe 60 PID 1704 wrote to memory of 3984 1704 e57c7d4.exe 61 PID 1704 wrote to memory of 3884 1704 e57c7d4.exe 62 PID 1704 wrote to memory of 3180 1704 e57c7d4.exe 75 PID 1704 wrote to memory of 5044 1704 e57c7d4.exe 76 PID 1704 wrote to memory of 3940 1704 e57c7d4.exe 81 PID 1704 wrote to memory of 4420 1704 e57c7d4.exe 82 PID 1704 wrote to memory of 3596 1704 e57c7d4.exe 85 PID 1704 wrote to memory of 3596 1704 e57c7d4.exe 85 PID 4428 wrote to memory of 2428 4428 rundll32.exe 86 PID 4428 wrote to memory of 2428 4428 rundll32.exe 86 PID 4428 wrote to memory of 2428 4428 rundll32.exe 86 PID 2428 wrote to memory of 788 2428 e57f201.exe 8 PID 2428 wrote to memory of 796 2428 e57f201.exe 9 PID 2428 wrote to memory of 332 2428 e57f201.exe 13 PID 2428 wrote to memory of 2700 2428 e57f201.exe 45 PID 2428 wrote to memory of 2788 2428 e57f201.exe 49 PID 2428 wrote to memory of 3060 2428 e57f201.exe 52 PID 2428 wrote to memory of 3420 2428 e57f201.exe 56 PID 2428 wrote to memory of 3540 2428 e57f201.exe 57 PID 2428 wrote to memory of 3716 2428 e57f201.exe 58 PID 2428 wrote to memory of 3804 2428 e57f201.exe 59 PID 2428 wrote to memory of 3900 2428 e57f201.exe 60 PID 2428 wrote to memory of 3984 2428 e57f201.exe 61 PID 2428 wrote to memory of 3884 2428 e57f201.exe 62 PID 2428 wrote to memory of 3180 2428 e57f201.exe 75 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c7d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f201.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2788
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3060
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ee9abd2adedeade729a1766a01d1cf7ad4b934bdfeca5ff05b6ef4dedd82f4cN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ee9abd2adedeade729a1766a01d1cf7ad4b934bdfeca5ff05b6ef4dedd82f4cN.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\e57c7d4.exeC:\Users\Admin\AppData\Local\Temp\e57c7d4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\e57c98a.exeC:\Users\Admin\AppData\Local\Temp\e57c98a.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3596
-
-
C:\Users\Admin\AppData\Local\Temp\e57f201.exeC:\Users\Admin\AppData\Local\Temp\e57f201.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2428
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3716
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3804
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3884
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3180
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5044
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3940
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD534f971799386501f1eb4b400ee9a47d7
SHA1bd73c2d7962ab84a83023e4e9076a71b4af3846d
SHA2568f0c8dac86418ac6d45206c31339860246e5ff52e10d36eaff87aaa9900bcba6
SHA51253fd9fda87406ef2705db120d2b977be36aeed983987da3d3362610f1e79ac4a963dfe118139d11350a3910b6660d59af94c51ceb292e273ff5f50562357febf
-
Filesize
257B
MD51240eea31e02b6d657113ba127ba6a2c
SHA13e6776a17eab9ffc72e06584fa166b6e7dfb0fbd
SHA2561b09004542dad0460c88d5e95a2ccd75df83d2867b133fe9260e128712941715
SHA5127096e29b300267608136acf96dcb875a5afb82280bc0f420ee0fdc389bcaaeb04ff9ea0ed63a490405a74446444d6972db0378ee83dfa54a76d2d0a28676290e