Analysis
-
max time kernel
131s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe
Resource
win7-20241023-en
windows7-x64
18 signatures
150 seconds
General
-
Target
959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe
-
Size
81KB
-
MD5
60d7282c7bff18e91465bfb0546655e4
-
SHA1
2fb36fb01c9651fcd14b6c19244e1ca5fd2afeb1
-
SHA256
959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c
-
SHA512
6ef6c1eab4a95583d889b51e75aa8e83a975e9593f1e89dc2a4f1c19174ed2644a84897b71b7c0ab1b9fc07d6db9861a670b0decd56ca81f7c19bfa40cf3eff0
-
SSDEEP
1536:Ut0IjBp7Z8VNgIQrzjsh5Jtk5Hii53jmxhOvivC3yTcntSaqG91Hut:vUB56aHfQxhTC9tSFG910
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\V: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\Z: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\N: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\H: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\K: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\M: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\O: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\S: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\X: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\G: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\L: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\Q: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\T: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\W: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\I: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\J: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\P: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\U: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\Y: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened (read-only) \??\E: 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened for modification F:\autorun.inf 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
resource yara_rule behavioral1/memory/1596-1-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-3-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-4-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-5-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-7-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-9-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-6-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-10-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-8-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-11-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-12-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-28-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-29-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-30-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-32-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-33-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-35-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-36-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-38-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-39-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-50-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-52-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-54-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-55-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-57-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-59-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-63-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-65-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-67-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx behavioral1/memory/1596-66-0x0000000001DD0000-0x0000000002E5E000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe Token: SeDebugPrivilege 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 PID 1596 wrote to memory of 1028 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 17 PID 1596 wrote to memory of 1044 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 18 PID 1596 wrote to memory of 1100 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 20 PID 1596 wrote to memory of 1324 1596 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1028
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1044
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe"C:\Users\Admin\AppData\Local\Temp\959cae4be54c7411bbd4bc3c228364fe10530ec93c6935851c4413a80d63396c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1596
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1324
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD54294f269e5b4a5ee846aeeebe9cbb59d
SHA127b28ae1f74b5194f55a8fbcec6a80f7f826ec56
SHA256dc71f53aebc550312807f9db8c492095cdca203554da3589bbf293a099c200a7
SHA5129605e73d62e24cbf913c7f7da60a3b3a6a036564086a38ea2d3169749623b326d21b1961b8eff866c4d63d0b906fd831f92d8bd6c79fc91e254dab55e4bd3765