Analysis
-
max time kernel
32s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe
Resource
win7-20240708-en
windows7-x64
21 signatures
120 seconds
General
-
Target
615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe
-
Size
1.1MB
-
MD5
669b6cf51f911e95a00f1b2d29dbf3ea
-
SHA1
7b0d3fc8e9390eb59d16e2a490d14fdcf0e06458
-
SHA256
615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1
-
SHA512
43a5dee16bf807ffcc19fa68d122ef7e58a17703d0774d66c3f82bebda3ae1c7e13d9bfc5722dfe7019e08e1ad16d2c3b50647a07c33773a730d3d98c8fa549a
-
SSDEEP
24576:W1/aGLDCM4D8ayGMCPnXo8/ql8ahCKn+xnjbmf8NRUoNvo2OKVlnFr4sIZjUHt9v:FD8ayGM0Xonl84UHmf8NRUoNvo2OKVlz
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ahfiu.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahfiu.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" ahfiu.exe -
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
pid Process 2344 ahfiu.exe -
Executes dropped EXE 1 IoCs
pid Process 2344 ahfiu.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ahfiu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\ahfiu.exe" ahfiu.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahfiu.exe -
resource yara_rule behavioral2/memory/552-4-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-3-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-11-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-7-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-12-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-14-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-22-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-8-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-6-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/552-5-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2344-55-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-63-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-53-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-60-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-61-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-64-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-62-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-66-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-57-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-56-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-84-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-83-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-85-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-117-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-121-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-125-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-157-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-158-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-193-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-196-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-206-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-202-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-207-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-245-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-246-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-280-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-281-0x0000000002600000-0x000000000368E000-memory.dmp upx behavioral2/memory/2344-282-0x0000000002600000-0x000000000368E000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahfiu.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 2344 ahfiu.exe 2344 ahfiu.exe 2344 ahfiu.exe 2344 ahfiu.exe 2344 ahfiu.exe 2344 ahfiu.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Token: SeDebugPrivilege 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 552 wrote to memory of 760 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 8 PID 552 wrote to memory of 768 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 9 PID 552 wrote to memory of 60 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 13 PID 552 wrote to memory of 2712 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 49 PID 552 wrote to memory of 2756 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 50 PID 552 wrote to memory of 3060 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 52 PID 552 wrote to memory of 3392 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 56 PID 552 wrote to memory of 3556 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 57 PID 552 wrote to memory of 3736 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 58 PID 552 wrote to memory of 3828 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 59 PID 552 wrote to memory of 3888 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 60 PID 552 wrote to memory of 4004 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 61 PID 552 wrote to memory of 3540 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 62 PID 552 wrote to memory of 1728 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 75 PID 552 wrote to memory of 4712 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 76 PID 552 wrote to memory of 2344 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 82 PID 552 wrote to memory of 2344 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 82 PID 552 wrote to memory of 2344 552 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe 82 PID 2344 wrote to memory of 760 2344 ahfiu.exe 8 PID 2344 wrote to memory of 768 2344 ahfiu.exe 9 PID 2344 wrote to memory of 60 2344 ahfiu.exe 13 PID 2344 wrote to memory of 2712 2344 ahfiu.exe 49 PID 2344 wrote to memory of 2756 2344 ahfiu.exe 50 PID 2344 wrote to memory of 3060 2344 ahfiu.exe 52 PID 2344 wrote to memory of 3392 2344 ahfiu.exe 56 PID 2344 wrote to memory of 3556 2344 ahfiu.exe 57 PID 2344 wrote to memory of 3736 2344 ahfiu.exe 58 PID 2344 wrote to memory of 3828 2344 ahfiu.exe 59 PID 2344 wrote to memory of 3888 2344 ahfiu.exe 60 PID 2344 wrote to memory of 4004 2344 ahfiu.exe 61 PID 2344 wrote to memory of 3540 2344 ahfiu.exe 62 PID 2344 wrote to memory of 1728 2344 ahfiu.exe 75 PID 2344 wrote to memory of 4712 2344 ahfiu.exe 76 PID 2344 wrote to memory of 760 2344 ahfiu.exe 8 PID 2344 wrote to memory of 768 2344 ahfiu.exe 9 PID 2344 wrote to memory of 60 2344 ahfiu.exe 13 PID 2344 wrote to memory of 2712 2344 ahfiu.exe 49 PID 2344 wrote to memory of 2756 2344 ahfiu.exe 50 PID 2344 wrote to memory of 3060 2344 ahfiu.exe 52 PID 2344 wrote to memory of 3392 2344 ahfiu.exe 56 PID 2344 wrote to memory of 3556 2344 ahfiu.exe 57 PID 2344 wrote to memory of 3736 2344 ahfiu.exe 58 PID 2344 wrote to memory of 3828 2344 ahfiu.exe 59 PID 2344 wrote to memory of 3888 2344 ahfiu.exe 60 PID 2344 wrote to memory of 4004 2344 ahfiu.exe 61 PID 2344 wrote to memory of 3540 2344 ahfiu.exe 62 PID 2344 wrote to memory of 1728 2344 ahfiu.exe 75 PID 2344 wrote to memory of 4712 2344 ahfiu.exe 76 PID 2344 wrote to memory of 760 2344 ahfiu.exe 8 PID 2344 wrote to memory of 768 2344 ahfiu.exe 9 PID 2344 wrote to memory of 60 2344 ahfiu.exe 13 PID 2344 wrote to memory of 2712 2344 ahfiu.exe 49 PID 2344 wrote to memory of 2756 2344 ahfiu.exe 50 PID 2344 wrote to memory of 3060 2344 ahfiu.exe 52 PID 2344 wrote to memory of 3392 2344 ahfiu.exe 56 PID 2344 wrote to memory of 3556 2344 ahfiu.exe 57 PID 2344 wrote to memory of 3736 2344 ahfiu.exe 58 PID 2344 wrote to memory of 3828 2344 ahfiu.exe 59 PID 2344 wrote to memory of 3888 2344 ahfiu.exe 60 PID 2344 wrote to memory of 4004 2344 ahfiu.exe 61 PID 2344 wrote to memory of 3540 2344 ahfiu.exe 62 PID 2344 wrote to memory of 1728 2344 ahfiu.exe 75 PID 2344 wrote to memory of 4712 2344 ahfiu.exe 76 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahfiu.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2756
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3060
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe"C:\Users\Admin\AppData\Local\Temp\615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:552 -
C:\ProgramData\ahfiu.exe"C:\ProgramData\ahfiu.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2344
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3828
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3540
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1728
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4712
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5b77441dd953c110d4e7d2e84bf12131a
SHA1a3f89d0bb3ee947a4b7f4b419524dc49e229552c
SHA256a636414a098f9f207d0785f5db6450d08e81c1318a98c981578b331a1331bf4a
SHA51209f053bec2d67df7b40e4101371d55e1d35ca14b16c750882a54f86716312e4ce2fe5f197fa31e0aeaca8ba0ece2cfb457b3485d6e3043ce197b24acc28708ec
-
Filesize
557KB
MD56f1656028d98fceaa83d9b6f8cc5459d
SHA17f2e990ad5347f6613683e7efa86f08ebfa9f4a6
SHA2562121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a
SHA512cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e
-
Filesize
522KB
MD5e5eb4edf90bd0f39551065e11904d766
SHA18bd449263b6e72a7bc0c54f63d76e84ed47ed008
SHA256d95e5ef8de06fec0d74f30ceac6dd1c83898459eaf9e5e59affe914b898fe7b5
SHA5127298e3bb063f1bf3a2dab4eb17442c8b8129acf89cf1efb931778f41bd11982c055ba833c78c3b8a76fd45ae2ccfb047959a1b54202891b4f413283d2402650a
-
Filesize
255B
MD5e5ac7ee83a75ee606a5b9899a4a29ad3
SHA1dad6bb392096b8659b3131c2c2c5bd40ca304667
SHA256176b5434cfbd337ee2a52e39332395b4aedfcc489fc21b29d9b386d66674ff86
SHA5124784006b1fe18e69ab1b0946b30840e87ee1530720d5f71d366b1fc27001d84ab9f4737f9b55753eeca4da9f7dac3fbe01e56050d6b58a8e68702debfd587eaa