Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 10:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca3520bb71238cd29971800742a2fdcf6f28b4b6ab2d1a197698c03c935f5f56.dll
Resource
win7-20241023-en
windows7-x64
17 signatures
150 seconds
General
-
Target
ca3520bb71238cd29971800742a2fdcf6f28b4b6ab2d1a197698c03c935f5f56.dll
-
Size
120KB
-
MD5
d6000b480c07a9743a193fe5abcfec48
-
SHA1
8e1956f5e235b5b6853497980b61b25e1740ef9e
-
SHA256
ca3520bb71238cd29971800742a2fdcf6f28b4b6ab2d1a197698c03c935f5f56
-
SHA512
5e29d0cef0e589943cced5f8fd2a6550fb42950483c87761833fd6c259b38644d4bcd9c2075ded6edd4020afd295935d02663865b30f1647be396ab4c55d3c01
-
SSDEEP
3072:WEG2BEWmETe8A76x77y7K89JFYQ26+tAcGnN:WEnEWmE68pXyW4JFC6+bGnN
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57db1e.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57db1e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57db1e.exe -
Executes dropped EXE 4 IoCs
pid Process 2316 e57ae12.exe 428 e57af3b.exe 2688 e57daef.exe 3384 e57db1e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57db1e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ae12.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57db1e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57db1e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57db1e.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: e57ae12.exe File opened (read-only) \??\H: e57ae12.exe File opened (read-only) \??\I: e57ae12.exe File opened (read-only) \??\J: e57ae12.exe File opened (read-only) \??\E: e57db1e.exe File opened (read-only) \??\G: e57ae12.exe File opened (read-only) \??\L: e57ae12.exe File opened (read-only) \??\I: e57db1e.exe File opened (read-only) \??\J: e57db1e.exe File opened (read-only) \??\E: e57ae12.exe File opened (read-only) \??\N: e57ae12.exe File opened (read-only) \??\G: e57db1e.exe File opened (read-only) \??\H: e57db1e.exe File opened (read-only) \??\K: e57ae12.exe -
resource yara_rule behavioral2/memory/2316-8-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-12-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-22-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-31-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-21-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-10-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-9-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-13-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-11-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-34-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-36-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-37-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-38-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-39-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-40-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-46-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-58-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-63-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-65-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-66-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-67-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-69-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-72-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-77-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2316-79-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3384-112-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3384-159-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3384-161-0x0000000000770000-0x000000000182A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57ae80 e57ae12.exe File opened for modification C:\Windows\SYSTEM.INI e57ae12.exe File created C:\Windows\e58027c e57db1e.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57ae12.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57af3b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57daef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57db1e.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2316 e57ae12.exe 2316 e57ae12.exe 2316 e57ae12.exe 2316 e57ae12.exe 3384 e57db1e.exe 3384 e57db1e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe Token: SeDebugPrivilege 2316 e57ae12.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3608 4816 rundll32.exe 82 PID 4816 wrote to memory of 3608 4816 rundll32.exe 82 PID 4816 wrote to memory of 3608 4816 rundll32.exe 82 PID 3608 wrote to memory of 2316 3608 rundll32.exe 83 PID 3608 wrote to memory of 2316 3608 rundll32.exe 83 PID 3608 wrote to memory of 2316 3608 rundll32.exe 83 PID 2316 wrote to memory of 768 2316 e57ae12.exe 8 PID 2316 wrote to memory of 776 2316 e57ae12.exe 9 PID 2316 wrote to memory of 64 2316 e57ae12.exe 13 PID 2316 wrote to memory of 2636 2316 e57ae12.exe 44 PID 2316 wrote to memory of 2648 2316 e57ae12.exe 45 PID 2316 wrote to memory of 2828 2316 e57ae12.exe 51 PID 2316 wrote to memory of 3432 2316 e57ae12.exe 56 PID 2316 wrote to memory of 3560 2316 e57ae12.exe 57 PID 2316 wrote to memory of 3744 2316 e57ae12.exe 58 PID 2316 wrote to memory of 3860 2316 e57ae12.exe 59 PID 2316 wrote to memory of 3928 2316 e57ae12.exe 60 PID 2316 wrote to memory of 4008 2316 e57ae12.exe 61 PID 2316 wrote to memory of 4108 2316 e57ae12.exe 62 PID 2316 wrote to memory of 4348 2316 e57ae12.exe 64 PID 2316 wrote to memory of 4416 2316 e57ae12.exe 76 PID 2316 wrote to memory of 4816 2316 e57ae12.exe 81 PID 2316 wrote to memory of 3608 2316 e57ae12.exe 82 PID 2316 wrote to memory of 3608 2316 e57ae12.exe 82 PID 3608 wrote to memory of 428 3608 rundll32.exe 84 PID 3608 wrote to memory of 428 3608 rundll32.exe 84 PID 3608 wrote to memory of 428 3608 rundll32.exe 84 PID 2316 wrote to memory of 768 2316 e57ae12.exe 8 PID 2316 wrote to memory of 776 2316 e57ae12.exe 9 PID 2316 wrote to memory of 64 2316 e57ae12.exe 13 PID 2316 wrote to memory of 2636 2316 e57ae12.exe 44 PID 2316 wrote to memory of 2648 2316 e57ae12.exe 45 PID 2316 wrote to memory of 2828 2316 e57ae12.exe 51 PID 2316 wrote to memory of 3432 2316 e57ae12.exe 56 PID 2316 wrote to memory of 3560 2316 e57ae12.exe 57 PID 2316 wrote to memory of 3744 2316 e57ae12.exe 58 PID 2316 wrote to memory of 3860 2316 e57ae12.exe 59 PID 2316 wrote to memory of 3928 2316 e57ae12.exe 60 PID 2316 wrote to memory of 4008 2316 e57ae12.exe 61 PID 2316 wrote to memory of 4108 2316 e57ae12.exe 62 PID 2316 wrote to memory of 4348 2316 e57ae12.exe 64 PID 2316 wrote to memory of 4416 2316 e57ae12.exe 76 PID 2316 wrote to memory of 4816 2316 e57ae12.exe 81 PID 2316 wrote to memory of 428 2316 e57ae12.exe 84 PID 2316 wrote to memory of 428 2316 e57ae12.exe 84 PID 3608 wrote to memory of 2688 3608 rundll32.exe 85 PID 3608 wrote to memory of 2688 3608 rundll32.exe 85 PID 3608 wrote to memory of 2688 3608 rundll32.exe 85 PID 3608 wrote to memory of 3384 3608 rundll32.exe 86 PID 3608 wrote to memory of 3384 3608 rundll32.exe 86 PID 3608 wrote to memory of 3384 3608 rundll32.exe 86 PID 3384 wrote to memory of 768 3384 e57db1e.exe 8 PID 3384 wrote to memory of 776 3384 e57db1e.exe 9 PID 3384 wrote to memory of 64 3384 e57db1e.exe 13 PID 3384 wrote to memory of 2636 3384 e57db1e.exe 44 PID 3384 wrote to memory of 2648 3384 e57db1e.exe 45 PID 3384 wrote to memory of 2828 3384 e57db1e.exe 51 PID 3384 wrote to memory of 3432 3384 e57db1e.exe 56 PID 3384 wrote to memory of 3560 3384 e57db1e.exe 57 PID 3384 wrote to memory of 3744 3384 e57db1e.exe 58 PID 3384 wrote to memory of 3860 3384 e57db1e.exe 59 PID 3384 wrote to memory of 3928 3384 e57db1e.exe 60 PID 3384 wrote to memory of 4008 3384 e57db1e.exe 61 PID 3384 wrote to memory of 4108 3384 e57db1e.exe 62 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ae12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57db1e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2648
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2828
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca3520bb71238cd29971800742a2fdcf6f28b4b6ab2d1a197698c03c935f5f56.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca3520bb71238cd29971800742a2fdcf6f28b4b6ab2d1a197698c03c935f5f56.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\e57ae12.exeC:\Users\Admin\AppData\Local\Temp\e57ae12.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2316
-
-
C:\Users\Admin\AppData\Local\Temp\e57af3b.exeC:\Users\Admin\AppData\Local\Temp\e57af3b.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:428
-
-
C:\Users\Admin\AppData\Local\Temp\e57daef.exeC:\Users\Admin\AppData\Local\Temp\e57daef.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\e57db1e.exeC:\Users\Admin\AppData\Local\Temp\e57db1e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3384
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3928
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4008
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4108
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4348
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4416
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5fafd8165729d676bada3bf706b55fca9
SHA17913da2b33b60c1ac750bc598338b48e6112bc98
SHA256a21f258699deb9f7097eb02896583f7e377cdefdd09fd8ec04c9f98f237a566a
SHA5124b47a2295a97aa376e30a1124bb5c24485a4391cbc6685b8408ed8fa5e6b3e02a57032c3fb98d63be8815715260355a9337573c00e2f1aba147c954e8a756148
-
Filesize
255B
MD5f03c4e8373f54c19b915866d28bb7d47
SHA1448ff2831a20a3d1f45623adde7f678bc8f9c57c
SHA256917c711c1bdcbaa7b1ee40fad9bdcc0b1f82d308ad966c2b915504a70d26bb9a
SHA512a948af9045a9a567b5c55fb69e4ced72ed4afea72dde008e3c25fb6215422d3ce1f2c7c8c53f6dd8d320a498237a1fe0721b81d4ca63f8060eaea4bd0f095058