Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5549cb15796422cd499c591d04fe003ef46dbc63da2b688d27bde9393ae5a4f.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
e5549cb15796422cd499c591d04fe003ef46dbc63da2b688d27bde9393ae5a4f.dll
-
Size
120KB
-
MD5
507b2d1563401849378a3801cf6d20eb
-
SHA1
8ab5680fde3e2d69bfcc1baa2a7ba923117a07fa
-
SHA256
e5549cb15796422cd499c591d04fe003ef46dbc63da2b688d27bde9393ae5a4f
-
SHA512
3f95897bdff8c506e25c47eb03c613c39e6c92d63ba6b0cf8b87b87f8f7f330e74a4e3a9059e1042fe2b0e0a5f0fdd7696458e0736e1d1b0298f429fd1011caf
-
SSDEEP
1536:Aft0NdWtumLEy8CWDMvdnO1BoXmXT+MZWry9x21yffIXX2GcDloC6mzilC0zRz3j:guCl2r6NO1AmD+AWry06sC/ulC0lTWc
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a095.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a095.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c40b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c40b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c40b.exe -
Executes dropped EXE 3 IoCs
pid Process 4888 e57a095.exe 4768 e57a2b8.exe 3292 e57c40b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a2b8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c40b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c40b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c40b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c40b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a095.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e57a095.exe File opened (read-only) \??\I: e57a095.exe File opened (read-only) \??\J: e57a095.exe File opened (read-only) \??\K: e57a095.exe File opened (read-only) \??\L: e57a095.exe File opened (read-only) \??\M: e57a095.exe File opened (read-only) \??\E: e57a095.exe File opened (read-only) \??\G: e57a095.exe -
resource yara_rule behavioral2/memory/4888-6-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-8-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-10-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-9-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-17-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-18-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-20-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-21-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-11-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-19-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-29-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-36-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-35-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-37-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-46-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-47-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-57-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-59-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-60-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-62-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-63-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-65-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-67-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-70-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4888-73-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4768-95-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/4768-102-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/4768-125-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e57a0f3 e57a095.exe File opened for modification C:\Windows\SYSTEM.INI e57a095.exe File created C:\Windows\e57f388 e57a2b8.exe File created C:\Windows\e581289 e57c40b.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c40b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a095.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a2b8.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4888 e57a095.exe 4888 e57a095.exe 4888 e57a095.exe 4888 e57a095.exe 4768 e57a2b8.exe 4768 e57a2b8.exe 3292 e57c40b.exe 3292 e57c40b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe Token: SeDebugPrivilege 4888 e57a095.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 1428 2656 rundll32.exe 83 PID 2656 wrote to memory of 1428 2656 rundll32.exe 83 PID 2656 wrote to memory of 1428 2656 rundll32.exe 83 PID 1428 wrote to memory of 4888 1428 rundll32.exe 84 PID 1428 wrote to memory of 4888 1428 rundll32.exe 84 PID 1428 wrote to memory of 4888 1428 rundll32.exe 84 PID 4888 wrote to memory of 772 4888 e57a095.exe 8 PID 4888 wrote to memory of 776 4888 e57a095.exe 9 PID 4888 wrote to memory of 316 4888 e57a095.exe 13 PID 4888 wrote to memory of 2712 4888 e57a095.exe 49 PID 4888 wrote to memory of 2808 4888 e57a095.exe 50 PID 4888 wrote to memory of 2320 4888 e57a095.exe 52 PID 4888 wrote to memory of 3456 4888 e57a095.exe 56 PID 4888 wrote to memory of 3596 4888 e57a095.exe 57 PID 4888 wrote to memory of 3772 4888 e57a095.exe 58 PID 4888 wrote to memory of 3884 4888 e57a095.exe 59 PID 4888 wrote to memory of 3976 4888 e57a095.exe 60 PID 4888 wrote to memory of 4072 4888 e57a095.exe 61 PID 4888 wrote to memory of 3944 4888 e57a095.exe 62 PID 4888 wrote to memory of 1104 4888 e57a095.exe 74 PID 4888 wrote to memory of 3240 4888 e57a095.exe 76 PID 4888 wrote to memory of 3752 4888 e57a095.exe 81 PID 4888 wrote to memory of 2656 4888 e57a095.exe 82 PID 4888 wrote to memory of 1428 4888 e57a095.exe 83 PID 4888 wrote to memory of 1428 4888 e57a095.exe 83 PID 1428 wrote to memory of 4768 1428 rundll32.exe 85 PID 1428 wrote to memory of 4768 1428 rundll32.exe 85 PID 1428 wrote to memory of 4768 1428 rundll32.exe 85 PID 1428 wrote to memory of 3292 1428 rundll32.exe 86 PID 1428 wrote to memory of 3292 1428 rundll32.exe 86 PID 1428 wrote to memory of 3292 1428 rundll32.exe 86 PID 4888 wrote to memory of 772 4888 e57a095.exe 8 PID 4888 wrote to memory of 776 4888 e57a095.exe 9 PID 4888 wrote to memory of 316 4888 e57a095.exe 13 PID 4888 wrote to memory of 2712 4888 e57a095.exe 49 PID 4888 wrote to memory of 2808 4888 e57a095.exe 50 PID 4888 wrote to memory of 2320 4888 e57a095.exe 52 PID 4888 wrote to memory of 3456 4888 e57a095.exe 56 PID 4888 wrote to memory of 3596 4888 e57a095.exe 57 PID 4888 wrote to memory of 3772 4888 e57a095.exe 58 PID 4888 wrote to memory of 3884 4888 e57a095.exe 59 PID 4888 wrote to memory of 3976 4888 e57a095.exe 60 PID 4888 wrote to memory of 4072 4888 e57a095.exe 61 PID 4888 wrote to memory of 3944 4888 e57a095.exe 62 PID 4888 wrote to memory of 1104 4888 e57a095.exe 74 PID 4888 wrote to memory of 3240 4888 e57a095.exe 76 PID 4888 wrote to memory of 3752 4888 e57a095.exe 81 PID 4888 wrote to memory of 4768 4888 e57a095.exe 85 PID 4888 wrote to memory of 4768 4888 e57a095.exe 85 PID 4888 wrote to memory of 3292 4888 e57a095.exe 86 PID 4888 wrote to memory of 3292 4888 e57a095.exe 86 PID 4768 wrote to memory of 772 4768 e57a2b8.exe 8 PID 4768 wrote to memory of 776 4768 e57a2b8.exe 9 PID 4768 wrote to memory of 316 4768 e57a2b8.exe 13 PID 4768 wrote to memory of 2712 4768 e57a2b8.exe 49 PID 4768 wrote to memory of 2808 4768 e57a2b8.exe 50 PID 4768 wrote to memory of 2320 4768 e57a2b8.exe 52 PID 4768 wrote to memory of 3456 4768 e57a2b8.exe 56 PID 4768 wrote to memory of 3596 4768 e57a2b8.exe 57 PID 4768 wrote to memory of 3772 4768 e57a2b8.exe 58 PID 4768 wrote to memory of 3884 4768 e57a2b8.exe 59 PID 4768 wrote to memory of 3976 4768 e57a2b8.exe 60 PID 4768 wrote to memory of 4072 4768 e57a2b8.exe 61 PID 4768 wrote to memory of 3944 4768 e57a2b8.exe 62 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a2b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c40b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2808
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2320
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5549cb15796422cd499c591d04fe003ef46dbc63da2b688d27bde9393ae5a4f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5549cb15796422cd499c591d04fe003ef46dbc63da2b688d27bde9393ae5a4f.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\e57a095.exeC:\Users\Admin\AppData\Local\Temp\e57a095.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\e57a2b8.exeC:\Users\Admin\AppData\Local\Temp\e57a2b8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4768
-
-
C:\Users\Admin\AppData\Local\Temp\e57c40b.exeC:\Users\Admin\AppData\Local\Temp\e57c40b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:3292
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3772
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4072
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3944
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1104
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3240
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3752
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5907987b3deb81b1e0824a0ceaed76ad9
SHA1ee78868b1f18e4c9d974d69e80512fc5de53b290
SHA25668932319b942217ef4a269234e34a29c5c71acbc237fc25401bc12b6572fd0be
SHA5121ed1e76eb2ecde6db266b2d888d2038a3297256e5313dd74f1933709dcab394804045ac74e6a536e752e218ac6360f45612d454a8f945eb17c89635558227bf7
-
Filesize
257B
MD57cf825166184f0fa6b02d39321fbef09
SHA1348bbc79405e415d3da13182d4b405b05d66bcad
SHA256133b02c9cc63fa8a142778d4e09aef49daec594fae833eea41b9b7e8d75cdc78
SHA5128a407a596d9d6b02c3feb6f6e91df0589cff32a6505d1faaed152e89edac94bbd541e55b47d2ac1affebb52732799d12c23ffe420f2372388dcf593b60a8e274