Analysis
-
max time kernel
94s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb2fcc7fa6cd52235086d536dfead1ed5f4f8b75105c773bc948e6b0cfc71cf7.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
General
-
Target
eb2fcc7fa6cd52235086d536dfead1ed5f4f8b75105c773bc948e6b0cfc71cf7.dll
-
Size
120KB
-
MD5
3e628f7e7eab42835c4c72ff36a42a22
-
SHA1
af884fd4241439b4b0e824bee5c649f2198c4d26
-
SHA256
eb2fcc7fa6cd52235086d536dfead1ed5f4f8b75105c773bc948e6b0cfc71cf7
-
SHA512
e1d4673165e0cbb17a93b7cfd665d015a8570e4396c12bcb530ec3a1111f7f2b2bcaa13663b14c3ddac734385f8b1839d27193794e3cae289056738cf245ee05
-
SSDEEP
3072:vGfgQSteacMnXMNJpC0oaci9Lb3FEA/r:v8UceEpC0DT
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57aedd.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ca74.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57aedd.exe -
Executes dropped EXE 4 IoCs
pid Process 116 e57aedd.exe 3736 e57b006.exe 3948 e57ca55.exe 3360 e57ca74.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57aedd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ca74.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ca74.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ca74.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e57aedd.exe File opened (read-only) \??\K: e57aedd.exe File opened (read-only) \??\R: e57aedd.exe File opened (read-only) \??\E: e57aedd.exe File opened (read-only) \??\L: e57aedd.exe File opened (read-only) \??\M: e57aedd.exe File opened (read-only) \??\P: e57aedd.exe File opened (read-only) \??\I: e57aedd.exe File opened (read-only) \??\Q: e57aedd.exe File opened (read-only) \??\G: e57aedd.exe File opened (read-only) \??\H: e57aedd.exe File opened (read-only) \??\N: e57aedd.exe File opened (read-only) \??\O: e57aedd.exe File opened (read-only) \??\S: e57aedd.exe File opened (read-only) \??\E: e57ca74.exe -
resource yara_rule behavioral2/memory/116-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-11-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-12-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-30-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-26-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-33-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-13-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-27-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-35-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-36-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-39-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-41-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-42-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-55-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-60-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-61-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-75-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-77-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-80-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-83-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-84-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-86-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-87-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-91-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-94-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/116-98-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3360-127-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/3360-165-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe e57aedd.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57aedd.exe File opened for modification C:\Program Files\7-Zip\7z.exe e57aedd.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57aedd.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57ff4f e57ca74.exe File created C:\Windows\e57af2c e57aedd.exe File opened for modification C:\Windows\SYSTEM.INI e57aedd.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57ca55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57ca74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57aedd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b006.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 116 e57aedd.exe 116 e57aedd.exe 116 e57aedd.exe 116 e57aedd.exe 3360 e57ca74.exe 3360 e57ca74.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe Token: SeDebugPrivilege 116 e57aedd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 2176 1240 rundll32.exe 82 PID 1240 wrote to memory of 2176 1240 rundll32.exe 82 PID 1240 wrote to memory of 2176 1240 rundll32.exe 82 PID 2176 wrote to memory of 116 2176 rundll32.exe 83 PID 2176 wrote to memory of 116 2176 rundll32.exe 83 PID 2176 wrote to memory of 116 2176 rundll32.exe 83 PID 116 wrote to memory of 760 116 e57aedd.exe 8 PID 116 wrote to memory of 768 116 e57aedd.exe 9 PID 116 wrote to memory of 64 116 e57aedd.exe 13 PID 116 wrote to memory of 2496 116 e57aedd.exe 42 PID 116 wrote to memory of 2516 116 e57aedd.exe 43 PID 116 wrote to memory of 2800 116 e57aedd.exe 48 PID 116 wrote to memory of 3520 116 e57aedd.exe 56 PID 116 wrote to memory of 3688 116 e57aedd.exe 57 PID 116 wrote to memory of 3864 116 e57aedd.exe 58 PID 116 wrote to memory of 4020 116 e57aedd.exe 59 PID 116 wrote to memory of 4084 116 e57aedd.exe 60 PID 116 wrote to memory of 816 116 e57aedd.exe 61 PID 116 wrote to memory of 4120 116 e57aedd.exe 62 PID 116 wrote to memory of 724 116 e57aedd.exe 74 PID 116 wrote to memory of 4524 116 e57aedd.exe 76 PID 116 wrote to memory of 1240 116 e57aedd.exe 81 PID 116 wrote to memory of 2176 116 e57aedd.exe 82 PID 116 wrote to memory of 2176 116 e57aedd.exe 82 PID 2176 wrote to memory of 3736 2176 rundll32.exe 84 PID 2176 wrote to memory of 3736 2176 rundll32.exe 84 PID 2176 wrote to memory of 3736 2176 rundll32.exe 84 PID 2176 wrote to memory of 3948 2176 rundll32.exe 85 PID 2176 wrote to memory of 3948 2176 rundll32.exe 85 PID 2176 wrote to memory of 3948 2176 rundll32.exe 85 PID 2176 wrote to memory of 3360 2176 rundll32.exe 86 PID 2176 wrote to memory of 3360 2176 rundll32.exe 86 PID 2176 wrote to memory of 3360 2176 rundll32.exe 86 PID 116 wrote to memory of 760 116 e57aedd.exe 8 PID 116 wrote to memory of 768 116 e57aedd.exe 9 PID 116 wrote to memory of 64 116 e57aedd.exe 13 PID 116 wrote to memory of 2496 116 e57aedd.exe 42 PID 116 wrote to memory of 2516 116 e57aedd.exe 43 PID 116 wrote to memory of 2800 116 e57aedd.exe 48 PID 116 wrote to memory of 3520 116 e57aedd.exe 56 PID 116 wrote to memory of 3688 116 e57aedd.exe 57 PID 116 wrote to memory of 3864 116 e57aedd.exe 58 PID 116 wrote to memory of 4020 116 e57aedd.exe 59 PID 116 wrote to memory of 4084 116 e57aedd.exe 60 PID 116 wrote to memory of 816 116 e57aedd.exe 61 PID 116 wrote to memory of 4120 116 e57aedd.exe 62 PID 116 wrote to memory of 724 116 e57aedd.exe 74 PID 116 wrote to memory of 4524 116 e57aedd.exe 76 PID 116 wrote to memory of 3736 116 e57aedd.exe 84 PID 116 wrote to memory of 3736 116 e57aedd.exe 84 PID 116 wrote to memory of 3948 116 e57aedd.exe 85 PID 116 wrote to memory of 3948 116 e57aedd.exe 85 PID 116 wrote to memory of 3360 116 e57aedd.exe 86 PID 116 wrote to memory of 3360 116 e57aedd.exe 86 PID 3360 wrote to memory of 760 3360 e57ca74.exe 8 PID 3360 wrote to memory of 768 3360 e57ca74.exe 9 PID 3360 wrote to memory of 64 3360 e57ca74.exe 13 PID 3360 wrote to memory of 2496 3360 e57ca74.exe 42 PID 3360 wrote to memory of 2516 3360 e57ca74.exe 43 PID 3360 wrote to memory of 2800 3360 e57ca74.exe 48 PID 3360 wrote to memory of 3520 3360 e57ca74.exe 56 PID 3360 wrote to memory of 3688 3360 e57ca74.exe 57 PID 3360 wrote to memory of 3864 3360 e57ca74.exe 58 PID 3360 wrote to memory of 4020 3360 e57ca74.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57aedd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ca74.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2516
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2800
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb2fcc7fa6cd52235086d536dfead1ed5f4f8b75105c773bc948e6b0cfc71cf7.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb2fcc7fa6cd52235086d536dfead1ed5f4f8b75105c773bc948e6b0cfc71cf7.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\e57aedd.exeC:\Users\Admin\AppData\Local\Temp\e57aedd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:116
-
-
C:\Users\Admin\AppData\Local\Temp\e57b006.exeC:\Users\Admin\AppData\Local\Temp\e57b006.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3736
-
-
C:\Users\Admin\AppData\Local\Temp\e57ca55.exeC:\Users\Admin\AppData\Local\Temp\e57ca55.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948
-
-
C:\Users\Admin\AppData\Local\Temp\e57ca74.exeC:\Users\Admin\AppData\Local\Temp\e57ca74.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3360
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3688
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4020
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4084
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:816
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4120
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:724
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4524
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD599b3ac0910f491b5ee53f5cddfd847b3
SHA118309fee47e3d3cd8f4c5979d8ef41102dac5ad8
SHA2561ee3566f1f53b89eecfea2d75be2dc7a3485de895ca570531f0a561120fea20c
SHA51249855856424ca8bd6b8caac75300518acfaa6d08e966ba6bb31db979798778db0ca3a57d23fb589a8f1e282551fd4eecc6dc3c0c8d9a92def417ecfc6dee6ab6
-
Filesize
257B
MD559ff47f9c6c30766ca52628300615263
SHA1a58cb525e95ea19dd602344dbd4a4b51a28d1a2b
SHA256736bb851a6012aef23a422f572b63843f4550e17ceb4e4f7509d887963e9cc50
SHA5127c1c9043a56b128feb86068e40b5b188250ffe85cb545f8c7cd23cb2bd847b54820a4eadc47a1270764ddd9e30f69398e1c4e8c54931e60f9c15006889fcc08c