Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 14:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
677070949ac805024615191614fb426d8ce95610b028fe307b05245c221c0633N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
677070949ac805024615191614fb426d8ce95610b028fe307b05245c221c0633N.dll
-
Size
120KB
-
MD5
4480c704a2d26c481758e8352cda4210
-
SHA1
58aa76c4ec63ee891a231c260e3c04161a465e7b
-
SHA256
677070949ac805024615191614fb426d8ce95610b028fe307b05245c221c0633
-
SHA512
26328782d483ae87cedcf098c001fe593ea5994a1215a4388a4674359965e96fe276ceabfe46e34d3e5f76994bffb08c28e77cbc145477d09ed9f725ecfffb84
-
SSDEEP
3072:YSHlBQ704onYUVeh5pmAJJTCTXzNn9wnJ13:zHlaQFqzxyzN94
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57d15a.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b5e2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57d15a.exe -
Executes dropped EXE 4 IoCs
pid Process 3544 e57b5e2.exe 764 e57b7d6.exe 4416 e57d13a.exe 1676 e57d15a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b5e2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57d15a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57d15a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57d15a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d15a.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e57b5e2.exe File opened (read-only) \??\K: e57b5e2.exe File opened (read-only) \??\M: e57b5e2.exe File opened (read-only) \??\O: e57b5e2.exe File opened (read-only) \??\E: e57b5e2.exe File opened (read-only) \??\I: e57b5e2.exe File opened (read-only) \??\N: e57b5e2.exe File opened (read-only) \??\Q: e57b5e2.exe File opened (read-only) \??\S: e57b5e2.exe File opened (read-only) \??\J: e57b5e2.exe File opened (read-only) \??\R: e57b5e2.exe File opened (read-only) \??\H: e57b5e2.exe File opened (read-only) \??\L: e57b5e2.exe File opened (read-only) \??\P: e57b5e2.exe File opened (read-only) \??\T: e57b5e2.exe File opened (read-only) \??\E: e57d15a.exe -
resource yara_rule behavioral2/memory/3544-8-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-6-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-10-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-19-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-12-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-20-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-25-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-18-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-11-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-9-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-35-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-36-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-37-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-39-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-38-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-41-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-42-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-54-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-60-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-61-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-75-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-77-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-80-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-82-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-83-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-85-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-84-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-87-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-92-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-95-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-96-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3544-97-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1676-132-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/1676-167-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57b5e2.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57b5e2.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57b5e2.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57b5e2.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5806a2 e57d15a.exe File created C:\Windows\e57b640 e57b5e2.exe File opened for modification C:\Windows\SYSTEM.INI e57b5e2.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b5e2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b7d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57d13a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57d15a.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3544 e57b5e2.exe 3544 e57b5e2.exe 3544 e57b5e2.exe 3544 e57b5e2.exe 1676 e57d15a.exe 1676 e57d15a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe Token: SeDebugPrivilege 3544 e57b5e2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2860 2184 rundll32.exe 85 PID 2184 wrote to memory of 2860 2184 rundll32.exe 85 PID 2184 wrote to memory of 2860 2184 rundll32.exe 85 PID 2860 wrote to memory of 3544 2860 rundll32.exe 86 PID 2860 wrote to memory of 3544 2860 rundll32.exe 86 PID 2860 wrote to memory of 3544 2860 rundll32.exe 86 PID 3544 wrote to memory of 772 3544 e57b5e2.exe 8 PID 3544 wrote to memory of 780 3544 e57b5e2.exe 9 PID 3544 wrote to memory of 316 3544 e57b5e2.exe 13 PID 3544 wrote to memory of 2984 3544 e57b5e2.exe 50 PID 3544 wrote to memory of 3052 3544 e57b5e2.exe 52 PID 3544 wrote to memory of 2556 3544 e57b5e2.exe 53 PID 3544 wrote to memory of 3388 3544 e57b5e2.exe 55 PID 3544 wrote to memory of 3568 3544 e57b5e2.exe 57 PID 3544 wrote to memory of 3764 3544 e57b5e2.exe 58 PID 3544 wrote to memory of 3848 3544 e57b5e2.exe 59 PID 3544 wrote to memory of 3912 3544 e57b5e2.exe 60 PID 3544 wrote to memory of 4008 3544 e57b5e2.exe 61 PID 3544 wrote to memory of 3488 3544 e57b5e2.exe 62 PID 3544 wrote to memory of 4868 3544 e57b5e2.exe 64 PID 3544 wrote to memory of 1968 3544 e57b5e2.exe 76 PID 3544 wrote to memory of 4092 3544 e57b5e2.exe 83 PID 3544 wrote to memory of 2184 3544 e57b5e2.exe 84 PID 3544 wrote to memory of 2860 3544 e57b5e2.exe 85 PID 3544 wrote to memory of 2860 3544 e57b5e2.exe 85 PID 2860 wrote to memory of 764 2860 rundll32.exe 87 PID 2860 wrote to memory of 764 2860 rundll32.exe 87 PID 2860 wrote to memory of 764 2860 rundll32.exe 87 PID 2860 wrote to memory of 4416 2860 rundll32.exe 89 PID 2860 wrote to memory of 4416 2860 rundll32.exe 89 PID 2860 wrote to memory of 4416 2860 rundll32.exe 89 PID 2860 wrote to memory of 1676 2860 rundll32.exe 90 PID 2860 wrote to memory of 1676 2860 rundll32.exe 90 PID 2860 wrote to memory of 1676 2860 rundll32.exe 90 PID 3544 wrote to memory of 772 3544 e57b5e2.exe 8 PID 3544 wrote to memory of 780 3544 e57b5e2.exe 9 PID 3544 wrote to memory of 316 3544 e57b5e2.exe 13 PID 3544 wrote to memory of 2984 3544 e57b5e2.exe 50 PID 3544 wrote to memory of 3052 3544 e57b5e2.exe 52 PID 3544 wrote to memory of 2556 3544 e57b5e2.exe 53 PID 3544 wrote to memory of 3388 3544 e57b5e2.exe 55 PID 3544 wrote to memory of 3568 3544 e57b5e2.exe 57 PID 3544 wrote to memory of 3764 3544 e57b5e2.exe 58 PID 3544 wrote to memory of 3848 3544 e57b5e2.exe 59 PID 3544 wrote to memory of 3912 3544 e57b5e2.exe 60 PID 3544 wrote to memory of 4008 3544 e57b5e2.exe 61 PID 3544 wrote to memory of 3488 3544 e57b5e2.exe 62 PID 3544 wrote to memory of 4868 3544 e57b5e2.exe 64 PID 3544 wrote to memory of 1968 3544 e57b5e2.exe 76 PID 3544 wrote to memory of 764 3544 e57b5e2.exe 87 PID 3544 wrote to memory of 764 3544 e57b5e2.exe 87 PID 3544 wrote to memory of 4416 3544 e57b5e2.exe 89 PID 3544 wrote to memory of 4416 3544 e57b5e2.exe 89 PID 3544 wrote to memory of 1676 3544 e57b5e2.exe 90 PID 3544 wrote to memory of 1676 3544 e57b5e2.exe 90 PID 1676 wrote to memory of 772 1676 e57d15a.exe 8 PID 1676 wrote to memory of 780 1676 e57d15a.exe 9 PID 1676 wrote to memory of 316 1676 e57d15a.exe 13 PID 1676 wrote to memory of 2984 1676 e57d15a.exe 50 PID 1676 wrote to memory of 3052 1676 e57d15a.exe 52 PID 1676 wrote to memory of 2556 1676 e57d15a.exe 53 PID 1676 wrote to memory of 3388 1676 e57d15a.exe 55 PID 1676 wrote to memory of 3568 1676 e57d15a.exe 57 PID 1676 wrote to memory of 3764 1676 e57d15a.exe 58 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b5e2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d15a.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3052
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2556
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\677070949ac805024615191614fb426d8ce95610b028fe307b05245c221c0633N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\677070949ac805024615191614fb426d8ce95610b028fe307b05245c221c0633N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\e57b5e2.exeC:\Users\Admin\AppData\Local\Temp\e57b5e2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3544
-
-
C:\Users\Admin\AppData\Local\Temp\e57b7d6.exeC:\Users\Admin\AppData\Local\Temp\e57b7d6.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\e57d13a.exeC:\Users\Admin\AppData\Local\Temp\e57d13a.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\e57d15a.exeC:\Users\Admin\AppData\Local\Temp\e57d15a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1676
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3848
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4008
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3488
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4868
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1968
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4092
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5d1403e0261f6c7c604276c4d2c729911
SHA121f656727431f6a24b7d7c2293c804f225f56dec
SHA256a7d14816470ec069f294889c9ef2279dc056147d941ef27d8666fa845db23e12
SHA5121727d1b01be8d3298364550fccbc1a00b6f48a281831a2b1c7e95447f284a47099c5a5142a78a61356129ba016d08adf56fa976c1f5942a7eb62baab8a6396a9
-
Filesize
257B
MD5d5d68aeb5b9b59c506286e8735e92183
SHA1030dd882724955ddc90bbccb5c9cd197c6433f70
SHA2562d62be80ee5e8f441c7b35ecf509227b1880bbd99920a7fd692ac17b04d42125
SHA512d607695de74b3479feb0fb88614aa9998ca33f8567cbfe5e177a87c3a1213cc14afc4f2a2f2959b0317881bc6da7ce54db591097cf01ca712d487346f2b0ab73