Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 22:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
788e2ff936c952126aa6fb15318e3a894deb71d8d194dec84daf2eeb8d2755a8.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
788e2ff936c952126aa6fb15318e3a894deb71d8d194dec84daf2eeb8d2755a8.dll
-
Size
120KB
-
MD5
bdc70e8f95c42e3b4453df15885504fa
-
SHA1
908822a9c557f512b792f6a200342cb214320558
-
SHA256
788e2ff936c952126aa6fb15318e3a894deb71d8d194dec84daf2eeb8d2755a8
-
SHA512
d50b47d226cdd10a573c2007c705beeb0895439a3fcb71af4edef028f18d5441d19484ae7c4eaa38e65ae96446aef1110ecc3e88a0d8eeb6b00508eb9026ecfb
-
SSDEEP
3072:Vg2lFovtoEit9B4uTCtWBpaROfpVvCPMYWV0q:VbyVC9p2tWBqSaPMYWW
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57980a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57980a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57bda3.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bda3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bda3.exe -
Executes dropped EXE 3 IoCs
pid Process 2312 e57980a.exe 4484 e5799ee.exe 4532 e57bda3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bda3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57bda3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57980a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bda3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bda3.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e57980a.exe File opened (read-only) \??\L: e57980a.exe File opened (read-only) \??\G: e57bda3.exe File opened (read-only) \??\I: e57bda3.exe File opened (read-only) \??\Q: e57980a.exe File opened (read-only) \??\H: e57bda3.exe File opened (read-only) \??\E: e57980a.exe File opened (read-only) \??\G: e57980a.exe File opened (read-only) \??\K: e57980a.exe File opened (read-only) \??\N: e57980a.exe File opened (read-only) \??\J: e57980a.exe File opened (read-only) \??\M: e57980a.exe File opened (read-only) \??\P: e57980a.exe File opened (read-only) \??\I: e57980a.exe File opened (read-only) \??\O: e57980a.exe File opened (read-only) \??\E: e57bda3.exe -
resource yara_rule behavioral2/memory/2312-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-29-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-30-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-20-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-13-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-14-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-42-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-43-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-52-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-63-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-64-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-66-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-70-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-71-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-73-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-74-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-77-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-78-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2312-80-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4532-116-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/4532-153-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe e57980a.exe File opened for modification C:\Program Files\7-Zip\7z.exe e57980a.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57980a.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e579877 e57980a.exe File opened for modification C:\Windows\SYSTEM.INI e57980a.exe File created C:\Windows\e57ea12 e57bda3.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57980a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5799ee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57bda3.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2312 e57980a.exe 2312 e57980a.exe 2312 e57980a.exe 2312 e57980a.exe 4532 e57bda3.exe 4532 e57bda3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe Token: SeDebugPrivilege 2312 e57980a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 3140 1096 rundll32.exe 82 PID 1096 wrote to memory of 3140 1096 rundll32.exe 82 PID 1096 wrote to memory of 3140 1096 rundll32.exe 82 PID 3140 wrote to memory of 2312 3140 rundll32.exe 83 PID 3140 wrote to memory of 2312 3140 rundll32.exe 83 PID 3140 wrote to memory of 2312 3140 rundll32.exe 83 PID 2312 wrote to memory of 776 2312 e57980a.exe 8 PID 2312 wrote to memory of 780 2312 e57980a.exe 9 PID 2312 wrote to memory of 392 2312 e57980a.exe 13 PID 2312 wrote to memory of 2832 2312 e57980a.exe 49 PID 2312 wrote to memory of 2848 2312 e57980a.exe 50 PID 2312 wrote to memory of 3044 2312 e57980a.exe 51 PID 2312 wrote to memory of 3488 2312 e57980a.exe 56 PID 2312 wrote to memory of 3604 2312 e57980a.exe 57 PID 2312 wrote to memory of 3800 2312 e57980a.exe 58 PID 2312 wrote to memory of 3892 2312 e57980a.exe 59 PID 2312 wrote to memory of 3956 2312 e57980a.exe 60 PID 2312 wrote to memory of 4036 2312 e57980a.exe 61 PID 2312 wrote to memory of 3556 2312 e57980a.exe 62 PID 2312 wrote to memory of 1496 2312 e57980a.exe 75 PID 2312 wrote to memory of 4556 2312 e57980a.exe 76 PID 2312 wrote to memory of 1096 2312 e57980a.exe 81 PID 2312 wrote to memory of 3140 2312 e57980a.exe 82 PID 2312 wrote to memory of 3140 2312 e57980a.exe 82 PID 3140 wrote to memory of 4484 3140 rundll32.exe 84 PID 3140 wrote to memory of 4484 3140 rundll32.exe 84 PID 3140 wrote to memory of 4484 3140 rundll32.exe 84 PID 3140 wrote to memory of 4532 3140 rundll32.exe 85 PID 3140 wrote to memory of 4532 3140 rundll32.exe 85 PID 3140 wrote to memory of 4532 3140 rundll32.exe 85 PID 2312 wrote to memory of 776 2312 e57980a.exe 8 PID 2312 wrote to memory of 780 2312 e57980a.exe 9 PID 2312 wrote to memory of 392 2312 e57980a.exe 13 PID 2312 wrote to memory of 2832 2312 e57980a.exe 49 PID 2312 wrote to memory of 2848 2312 e57980a.exe 50 PID 2312 wrote to memory of 3044 2312 e57980a.exe 51 PID 2312 wrote to memory of 3488 2312 e57980a.exe 56 PID 2312 wrote to memory of 3604 2312 e57980a.exe 57 PID 2312 wrote to memory of 3800 2312 e57980a.exe 58 PID 2312 wrote to memory of 3892 2312 e57980a.exe 59 PID 2312 wrote to memory of 3956 2312 e57980a.exe 60 PID 2312 wrote to memory of 4036 2312 e57980a.exe 61 PID 2312 wrote to memory of 3556 2312 e57980a.exe 62 PID 2312 wrote to memory of 1496 2312 e57980a.exe 75 PID 2312 wrote to memory of 4556 2312 e57980a.exe 76 PID 2312 wrote to memory of 4484 2312 e57980a.exe 84 PID 2312 wrote to memory of 4484 2312 e57980a.exe 84 PID 2312 wrote to memory of 4532 2312 e57980a.exe 85 PID 2312 wrote to memory of 4532 2312 e57980a.exe 85 PID 4532 wrote to memory of 776 4532 e57bda3.exe 8 PID 4532 wrote to memory of 780 4532 e57bda3.exe 9 PID 4532 wrote to memory of 392 4532 e57bda3.exe 13 PID 4532 wrote to memory of 2832 4532 e57bda3.exe 49 PID 4532 wrote to memory of 2848 4532 e57bda3.exe 50 PID 4532 wrote to memory of 3044 4532 e57bda3.exe 51 PID 4532 wrote to memory of 3488 4532 e57bda3.exe 56 PID 4532 wrote to memory of 3604 4532 e57bda3.exe 57 PID 4532 wrote to memory of 3800 4532 e57bda3.exe 58 PID 4532 wrote to memory of 3892 4532 e57bda3.exe 59 PID 4532 wrote to memory of 3956 4532 e57bda3.exe 60 PID 4532 wrote to memory of 4036 4532 e57bda3.exe 61 PID 4532 wrote to memory of 3556 4532 e57bda3.exe 62 PID 4532 wrote to memory of 1496 4532 e57bda3.exe 75 PID 4532 wrote to memory of 4556 4532 e57bda3.exe 76 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57980a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bda3.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:392
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2848
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3044
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\788e2ff936c952126aa6fb15318e3a894deb71d8d194dec84daf2eeb8d2755a8.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\788e2ff936c952126aa6fb15318e3a894deb71d8d194dec84daf2eeb8d2755a8.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\e57980a.exeC:\Users\Admin\AppData\Local\Temp\e57980a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\e5799ee.exeC:\Users\Admin\AppData\Local\Temp\e5799ee.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484
-
-
C:\Users\Admin\AppData\Local\Temp\e57bda3.exeC:\Users\Admin\AppData\Local\Temp\e57bda3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4532
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3800
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3892
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3956
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4036
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3556
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1496
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4556
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5d69b6827251e3c6758ab9bb431bfe031
SHA1929821ace57937c5049892a4328f149c139f73a4
SHA2562e921d12baf7fed935b38fd862fe97de348c9fe3c601c4772408a75990932b62
SHA512fb7007c3115b243af728403f3f65e643d362abc5d3989e31f10f888789f421e4bf5fb8dd6ce36bdbf84174e3842a4c19cff7156c1542313738694a71c938fc6f
-
Filesize
257B
MD50dee049ec658256986de1ab7d7592d91
SHA15cd03f47e783e06d24ec9878b8015c79ce8769b1
SHA256366a3efa1c68ee5949c4ba06a2c867c3fde2ce7d2264c97d764c08b654bf45db
SHA512cda120e233f966bbcc2e33cf77e1fa62155fe9812d61581f4b1b539555446c2e0f34865cb0926d7c4558e17c24e3ee84520d4031a0684c546b0339cfa9cc47bc