Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 02:15
Static task
static1
Behavioral task
behavioral1
Sample
212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
Resource
win7-20240903-en
General
-
Target
212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
-
Size
731KB
-
MD5
b5f0fe6474a3c76a48fe5f88a60dddfd
-
SHA1
cf8d5838c0d13fee1e353802760baa5bcd702afc
-
SHA256
212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f
-
SHA512
b941976ff443d4bd6795b8f098c76f323942259b65b491a6376b4897f6c1a2cdd35b880dd32d13ef908cb62e0113898e7b60868db93cf79e1ca8d34cd67284fb
-
SSDEEP
12288:jQD0guZ6F+dOSHJSKlskGb5+Iq5Ho0l1wFpZS9PmdVLAS8J+cSOcBu0J+4DDDDDk:Dgj1SHYaYlgBoGwFpAmVL8SO6+6aqfy1
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Executes dropped EXE 1 IoCs
pid Process 1072 update.exe -
Loads dropped DLL 3 IoCs
pid Process 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 1072 update.exe 1072 update.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\K: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\L: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\M: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\E: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\G: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\H: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\I: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
resource yara_rule behavioral2/memory/2908-1-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-11-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-12-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-19-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-20-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-24-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-25-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-21-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-4-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-3-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-8-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-49-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-36-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-81-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-82-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-83-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-85-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-86-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-87-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-89-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-93-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-98-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-99-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-103-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/2908-104-0x00000000024E0000-0x000000000359A000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\KB4018466.log update.exe File created C:\Windows\e578349 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened for modification C:\Windows\SYSTEM.INI 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened for modification C:\Windows\setupapi.log update.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language update.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2908 wrote to memory of 796 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 9 PID 2908 wrote to memory of 800 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 10 PID 2908 wrote to memory of 384 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 13 PID 2908 wrote to memory of 2808 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 49 PID 2908 wrote to memory of 2864 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 50 PID 2908 wrote to memory of 2984 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 51 PID 2908 wrote to memory of 3416 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 56 PID 2908 wrote to memory of 3564 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 57 PID 2908 wrote to memory of 3752 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 58 PID 2908 wrote to memory of 3840 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 59 PID 2908 wrote to memory of 3908 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 60 PID 2908 wrote to memory of 3992 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 61 PID 2908 wrote to memory of 4176 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 62 PID 2908 wrote to memory of 700 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 74 PID 2908 wrote to memory of 2612 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 76 PID 2908 wrote to memory of 3640 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 77 PID 2908 wrote to memory of 2272 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 78 PID 2908 wrote to memory of 5032 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 83 PID 2908 wrote to memory of 1072 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 85 PID 2908 wrote to memory of 1072 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 85 PID 2908 wrote to memory of 1072 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 85 PID 2908 wrote to memory of 796 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 9 PID 2908 wrote to memory of 800 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 10 PID 2908 wrote to memory of 384 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 13 PID 2908 wrote to memory of 2808 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 49 PID 2908 wrote to memory of 2864 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 50 PID 2908 wrote to memory of 2984 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 51 PID 2908 wrote to memory of 3416 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 56 PID 2908 wrote to memory of 3564 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 57 PID 2908 wrote to memory of 3752 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 58 PID 2908 wrote to memory of 3840 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 59 PID 2908 wrote to memory of 3908 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 60 PID 2908 wrote to memory of 3992 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 61 PID 2908 wrote to memory of 4176 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 62 PID 2908 wrote to memory of 700 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 74 PID 2908 wrote to memory of 2612 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 76 PID 2908 wrote to memory of 1072 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 85 PID 2908 wrote to memory of 1072 2908 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 85 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2864
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2984
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe"C:\Users\Admin\AppData\Local\Temp\212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2908 -
\??\c:\715fd27e5b73e844357b\update\update.exec:\715fd27e5b73e844357b\update\update.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1072
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3564
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4176
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:700
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2612
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3640
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2272
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5032
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5ee207e35aea4d5df41d90221e1b66efa
SHA1757469cf9ad2f21f267bbe730560114fdf8a89a5
SHA256cf64c95e9a2d02967efc22b00efb3736156b913a95231eb63c1df45d43475e64
SHA51243e9f75725daa4f3428b2d9cee2c2cc8b2f2e991b8e58d72d2f429fbdfb614c86d172f03d3f9da98756bd4e245643d9a57c6efa422d6c60ad364a2322245542d
-
Filesize
712KB
MD59570121468658dcc6972f1dfa624a223
SHA161716952df7a03fc01ac919f44f07e9588840b8c
SHA256bc2cde5db3027a726c81df78bdef10b5ec9a7b4a5ba297911c7b999638f76b33
SHA5127c2168a6db5bf7dd7c09682983e9059524621834d0d9ae250382c74d714b0e99b625f5ee9a648e18de9fa25b580bac5ab770ad63c406a9f88c87ade1a372429c
-
Filesize
331KB
MD5eb5c64286d987337f702813e73fcf615
SHA177c393b4cf5b61c29afa408ec1ebd93b22271e3f
SHA25644062d8525a1de307491a46376d1831e23c27c18edb3de8f142d83eb7a21fc52
SHA5120c71779a7b5a3507b5d0ccc0f9ff785032e1d8c32e76a0c0acadfd531d9ca87b61fd9742d69c610823a4315e181ad41f561811badbc262052d0f3ba86b9237a6
-
C:\Users\Admin\AppData\Local\Temp\0E578731_Rar\212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
Filesize667KB
MD5095b4c4ef08daef3f6060e7966522dee
SHA1144b7a0f42e7aaa8fa753d96235906f8a883a984
SHA256dcee5ca3863aa268f300d84b34cb2f316315fae27c58705486de4fbfb963dd4b
SHA5126f9ff5837d28aa54825e764451596a0a4ba5d8dcb55268809c10799f504e5f4cb9024c2cf70b72f6d880204ec452196557cc74984f90a262e2d972d8e0fa95a4