Analysis
-
max time kernel
119s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
120 seconds
General
-
Target
c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe
-
Size
97KB
-
MD5
d65186e8bc9f2646a74debf5bfa09450
-
SHA1
3d8593673d944df51a61f1a42e7f6767586053d6
-
SHA256
c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7c
-
SHA512
8fa516dc6cfe0c1bd3076d51e69364a2c7c8ec445b3d94cc533a2e4bb1c0fffd2d7e87aea050bb35a0a5a1627d4c631c32d5755c1d5055c7b5003967bc852b9b
-
SSDEEP
3072:ylTFPdnBPcyVFAyf8mcNi650nmRyqc504:m5VnC8umhk54LX
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\N: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\Y: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\S: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\T: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\U: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\W: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\J: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\M: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\P: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\Q: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\O: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\V: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\X: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\Z: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\E: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\G: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\H: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\K: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\L: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened (read-only) \??\R: c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened for modification F:\autorun.inf c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
resource yara_rule behavioral1/memory/756-1-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-9-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-4-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-6-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-3-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-7-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-5-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-11-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-10-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-8-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-30-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-31-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-32-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-33-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-34-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-36-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-37-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-39-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-40-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-42-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-43-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-51-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-53-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-55-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-60-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-68-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-69-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-76-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/756-77-0x0000000000590000-0x000000000164A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened for modification C:\Program Files\7-Zip\7z.exe c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f767f1f c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe File opened for modification C:\Windows\SYSTEM.INI c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe Token: SeDebugPrivilege 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 PID 756 wrote to memory of 1072 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 18 PID 756 wrote to memory of 1120 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 19 PID 756 wrote to memory of 1184 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 21 PID 756 wrote to memory of 324 756 c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1072
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1120
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe"C:\Users\Admin\AppData\Local\Temp\c365ea7f98ac7786cbaeb3e3ad8668ad70554d75adca5fc8ba322e177c41ea7cN.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:756
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:324
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD55eb2c14d552de7264f02bfd44d84e71d
SHA1a3da9ac00d6070da95f0a470914463b3e7120811
SHA2563c9ce346245841dd4496b06ed0011341b26725cbf0fa6c2998529ee1cfeb0f8d
SHA512381a6505358179648ab5defdb383791fc6797d9b60ac9e95e2c8b09dedc5e17b8a36bd51cb07598717363594b1209cfb726e866a4c8110eaa8843b99546c309d