Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a46d942725874d6f2b1bcd81b1f13511d18ec6fc66555c90b8640ed11dffa8aN.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
4a46d942725874d6f2b1bcd81b1f13511d18ec6fc66555c90b8640ed11dffa8aN.dll
-
Size
120KB
-
MD5
3ea8606e9583fbcb2bfe50a698d855c0
-
SHA1
ba4eb766126675919f15e4f08144b4b83d8bca4a
-
SHA256
4a46d942725874d6f2b1bcd81b1f13511d18ec6fc66555c90b8640ed11dffa8a
-
SHA512
d5220799b71d37e9e9029149346587bfb87d8d56de969ab5afcdf79cc32cae47ccd56d819ef53df13e8c6075d493c698819ae3cc2cad9ba6985907fa14da2e50
-
SSDEEP
1536:/9L3lELTLZ8E4/U1Y8Bjt5GOeFc1IiGP+AQY4yRTvO3pA/PnljrTR6qYhkzb1sH:530uEc+BfTeFtiGPEY4WOiPlj4hgb1k
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b565.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b565.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57d15a.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d15a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57d15a.exe -
Executes dropped EXE 4 IoCs
pid Process 1504 e57b565.exe 4880 e57bd06.exe 1496 e57d13a.exe 5008 e57d15a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57d15a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b565.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b565.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d15a.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57b565.exe File opened (read-only) \??\H: e57b565.exe File opened (read-only) \??\K: e57b565.exe File opened (read-only) \??\M: e57b565.exe File opened (read-only) \??\R: e57b565.exe File opened (read-only) \??\G: e57b565.exe File opened (read-only) \??\J: e57b565.exe File opened (read-only) \??\L: e57b565.exe File opened (read-only) \??\N: e57b565.exe File opened (read-only) \??\O: e57b565.exe File opened (read-only) \??\Q: e57b565.exe File opened (read-only) \??\S: e57b565.exe File opened (read-only) \??\P: e57b565.exe File opened (read-only) \??\E: e57d15a.exe File opened (read-only) \??\I: e57b565.exe -
resource yara_rule behavioral2/memory/1504-6-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-11-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-9-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-10-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-13-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-12-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-15-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-14-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-17-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-16-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-23-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-30-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-38-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-39-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-40-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-42-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-57-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-58-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-60-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-61-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-63-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-77-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-80-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-82-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-84-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-86-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-87-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-89-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-90-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-91-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1504-97-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/5008-136-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/5008-163-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57b565.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57b565.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57b565.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57b565.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e57b565.exe File created C:\Windows\e580c40 e57d15a.exe File created C:\Windows\e57b5f2 e57b565.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b565.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57bd06.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57d13a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57d15a.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1504 e57b565.exe 1504 e57b565.exe 1504 e57b565.exe 1504 e57b565.exe 5008 e57d15a.exe 5008 e57d15a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe Token: SeDebugPrivilege 1504 e57b565.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3580 wrote to memory of 4036 3580 rundll32.exe 83 PID 3580 wrote to memory of 4036 3580 rundll32.exe 83 PID 3580 wrote to memory of 4036 3580 rundll32.exe 83 PID 4036 wrote to memory of 1504 4036 rundll32.exe 84 PID 4036 wrote to memory of 1504 4036 rundll32.exe 84 PID 4036 wrote to memory of 1504 4036 rundll32.exe 84 PID 1504 wrote to memory of 800 1504 e57b565.exe 9 PID 1504 wrote to memory of 804 1504 e57b565.exe 10 PID 1504 wrote to memory of 384 1504 e57b565.exe 13 PID 1504 wrote to memory of 2568 1504 e57b565.exe 44 PID 1504 wrote to memory of 2588 1504 e57b565.exe 45 PID 1504 wrote to memory of 2784 1504 e57b565.exe 51 PID 1504 wrote to memory of 3540 1504 e57b565.exe 56 PID 1504 wrote to memory of 3684 1504 e57b565.exe 57 PID 1504 wrote to memory of 3860 1504 e57b565.exe 58 PID 1504 wrote to memory of 3952 1504 e57b565.exe 59 PID 1504 wrote to memory of 4012 1504 e57b565.exe 60 PID 1504 wrote to memory of 2836 1504 e57b565.exe 61 PID 1504 wrote to memory of 3552 1504 e57b565.exe 62 PID 1504 wrote to memory of 3232 1504 e57b565.exe 74 PID 1504 wrote to memory of 1252 1504 e57b565.exe 76 PID 1504 wrote to memory of 1628 1504 e57b565.exe 81 PID 1504 wrote to memory of 3580 1504 e57b565.exe 82 PID 1504 wrote to memory of 4036 1504 e57b565.exe 83 PID 1504 wrote to memory of 4036 1504 e57b565.exe 83 PID 4036 wrote to memory of 4880 4036 rundll32.exe 85 PID 4036 wrote to memory of 4880 4036 rundll32.exe 85 PID 4036 wrote to memory of 4880 4036 rundll32.exe 85 PID 4036 wrote to memory of 1496 4036 rundll32.exe 87 PID 4036 wrote to memory of 1496 4036 rundll32.exe 87 PID 4036 wrote to memory of 1496 4036 rundll32.exe 87 PID 4036 wrote to memory of 5008 4036 rundll32.exe 88 PID 4036 wrote to memory of 5008 4036 rundll32.exe 88 PID 4036 wrote to memory of 5008 4036 rundll32.exe 88 PID 1504 wrote to memory of 800 1504 e57b565.exe 9 PID 1504 wrote to memory of 804 1504 e57b565.exe 10 PID 1504 wrote to memory of 384 1504 e57b565.exe 13 PID 1504 wrote to memory of 2568 1504 e57b565.exe 44 PID 1504 wrote to memory of 2588 1504 e57b565.exe 45 PID 1504 wrote to memory of 2784 1504 e57b565.exe 51 PID 1504 wrote to memory of 3540 1504 e57b565.exe 56 PID 1504 wrote to memory of 3684 1504 e57b565.exe 57 PID 1504 wrote to memory of 3860 1504 e57b565.exe 58 PID 1504 wrote to memory of 3952 1504 e57b565.exe 59 PID 1504 wrote to memory of 4012 1504 e57b565.exe 60 PID 1504 wrote to memory of 2836 1504 e57b565.exe 61 PID 1504 wrote to memory of 3552 1504 e57b565.exe 62 PID 1504 wrote to memory of 3232 1504 e57b565.exe 74 PID 1504 wrote to memory of 1252 1504 e57b565.exe 76 PID 1504 wrote to memory of 4880 1504 e57b565.exe 85 PID 1504 wrote to memory of 4880 1504 e57b565.exe 85 PID 1504 wrote to memory of 1496 1504 e57b565.exe 87 PID 1504 wrote to memory of 1496 1504 e57b565.exe 87 PID 1504 wrote to memory of 5008 1504 e57b565.exe 88 PID 1504 wrote to memory of 5008 1504 e57b565.exe 88 PID 5008 wrote to memory of 800 5008 e57d15a.exe 9 PID 5008 wrote to memory of 804 5008 e57d15a.exe 10 PID 5008 wrote to memory of 384 5008 e57d15a.exe 13 PID 5008 wrote to memory of 2568 5008 e57d15a.exe 44 PID 5008 wrote to memory of 2588 5008 e57d15a.exe 45 PID 5008 wrote to memory of 2784 5008 e57d15a.exe 51 PID 5008 wrote to memory of 3540 5008 e57d15a.exe 56 PID 5008 wrote to memory of 3684 5008 e57d15a.exe 57 PID 5008 wrote to memory of 3860 5008 e57d15a.exe 58 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b565.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2588
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2784
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3540
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a46d942725874d6f2b1bcd81b1f13511d18ec6fc66555c90b8640ed11dffa8aN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a46d942725874d6f2b1bcd81b1f13511d18ec6fc66555c90b8640ed11dffa8aN.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\e57b565.exeC:\Users\Admin\AppData\Local\Temp\e57b565.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\e57bd06.exeC:\Users\Admin\AppData\Local\Temp\e57bd06.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4880
-
-
C:\Users\Admin\AppData\Local\Temp\e57d13a.exeC:\Users\Admin\AppData\Local\Temp\e57d13a.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\e57d15a.exeC:\Users\Admin\AppData\Local\Temp\e57d15a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5008
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3684
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3860
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4012
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3552
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3232
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1252
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1628
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD58cdf72896f2c58a4501bd2ccdb146946
SHA1b1de58d155024153c106fa36836cdbc788f88947
SHA256caa9759ecf7a4e8e51242f17982a28317413e83c53ff4d9f5040a972d0081957
SHA51236984ceda8bf89c12eb86220270e9d937720d8a848b8d7d2b0a146c034c08f3acc3e54ae54b14bc2d60454d7fb4d9e0dc8bc98c0b8c330dd120176fbf20b452e
-
Filesize
257B
MD5a7d830a2b06280cbcba5b19e7f4b9c72
SHA144b65069124bb3319a678b0f30f12e6041421b62
SHA25600877204eae4a70799fd49e1b5e6ef694ed88b806c3c88dba6da0e8dc2c30ca7
SHA5127b0eee477f10e78615adac9dac5831455c524e7e766fc33a154c850ae612d673d9ef58325e49fa52448aa58269affd1e16234d1ddef3844e94bb990df031d5b1