Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 10:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll
-
Size
120KB
-
MD5
0821ff500c73e6f59ca593cad897a16d
-
SHA1
32dcfd58213b81e7411121c1b82f3d6584fcbab2
-
SHA256
4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86
-
SHA512
eaf33582eb17a92dfbf8959bdc78232c7aced7a66fd49758dbbe7e4da4da0ed381e0c4b9583496694edceb155aa68930a5d01929a71212fc1467af8314d0804e
-
SSDEEP
3072:1kOJG3QLzHogFkNvIH2j/qOqE3Lf2bfteG:UUzHJkNl77f2bt
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578b58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578b58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a6cf.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a6cf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578b58.exe -
Executes dropped EXE 4 IoCs
pid Process 1292 e578b58.exe 2976 e578caf.exe 2448 e57a6bf.exe 4296 e57a6cf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578b58.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a6cf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a6cf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578b58.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e578b58.exe File opened (read-only) \??\M: e578b58.exe File opened (read-only) \??\O: e578b58.exe File opened (read-only) \??\S: e578b58.exe File opened (read-only) \??\K: e578b58.exe File opened (read-only) \??\L: e578b58.exe File opened (read-only) \??\R: e578b58.exe File opened (read-only) \??\E: e57a6cf.exe File opened (read-only) \??\E: e578b58.exe File opened (read-only) \??\N: e578b58.exe File opened (read-only) \??\Q: e578b58.exe File opened (read-only) \??\G: e57a6cf.exe File opened (read-only) \??\G: e578b58.exe File opened (read-only) \??\I: e578b58.exe File opened (read-only) \??\J: e578b58.exe File opened (read-only) \??\P: e578b58.exe -
resource yara_rule behavioral2/memory/1292-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-11-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-10-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-12-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-30-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-31-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-23-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-22-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-9-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-6-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-36-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-35-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-37-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-38-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-39-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-41-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-42-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-57-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-59-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-60-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-75-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-74-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-78-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-80-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-84-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-85-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-87-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-88-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-91-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-92-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1292-93-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4296-131-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4296-166-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e578b58.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e578b58.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e578b58.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578b58.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e578bb5 e578b58.exe File opened for modification C:\Windows\SYSTEM.INI e578b58.exe File created C:\Windows\e57db9b e57a6cf.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578b58.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578caf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a6bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a6cf.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1292 e578b58.exe 1292 e578b58.exe 1292 e578b58.exe 1292 e578b58.exe 4296 e57a6cf.exe 4296 e57a6cf.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe Token: SeDebugPrivilege 1292 e578b58.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 4696 4788 rundll32.exe 82 PID 4788 wrote to memory of 4696 4788 rundll32.exe 82 PID 4788 wrote to memory of 4696 4788 rundll32.exe 82 PID 4696 wrote to memory of 1292 4696 rundll32.exe 83 PID 4696 wrote to memory of 1292 4696 rundll32.exe 83 PID 4696 wrote to memory of 1292 4696 rundll32.exe 83 PID 1292 wrote to memory of 760 1292 e578b58.exe 8 PID 1292 wrote to memory of 768 1292 e578b58.exe 9 PID 1292 wrote to memory of 380 1292 e578b58.exe 13 PID 1292 wrote to memory of 2868 1292 e578b58.exe 49 PID 1292 wrote to memory of 2888 1292 e578b58.exe 50 PID 1292 wrote to memory of 3016 1292 e578b58.exe 52 PID 1292 wrote to memory of 3432 1292 e578b58.exe 56 PID 1292 wrote to memory of 3564 1292 e578b58.exe 57 PID 1292 wrote to memory of 3784 1292 e578b58.exe 58 PID 1292 wrote to memory of 3884 1292 e578b58.exe 59 PID 1292 wrote to memory of 3952 1292 e578b58.exe 60 PID 1292 wrote to memory of 4040 1292 e578b58.exe 61 PID 1292 wrote to memory of 4224 1292 e578b58.exe 62 PID 1292 wrote to memory of 4880 1292 e578b58.exe 74 PID 1292 wrote to memory of 1984 1292 e578b58.exe 76 PID 1292 wrote to memory of 4788 1292 e578b58.exe 81 PID 1292 wrote to memory of 4696 1292 e578b58.exe 82 PID 1292 wrote to memory of 4696 1292 e578b58.exe 82 PID 4696 wrote to memory of 2976 4696 rundll32.exe 84 PID 4696 wrote to memory of 2976 4696 rundll32.exe 84 PID 4696 wrote to memory of 2976 4696 rundll32.exe 84 PID 4696 wrote to memory of 2448 4696 rundll32.exe 85 PID 4696 wrote to memory of 2448 4696 rundll32.exe 85 PID 4696 wrote to memory of 2448 4696 rundll32.exe 85 PID 4696 wrote to memory of 4296 4696 rundll32.exe 86 PID 4696 wrote to memory of 4296 4696 rundll32.exe 86 PID 4696 wrote to memory of 4296 4696 rundll32.exe 86 PID 1292 wrote to memory of 760 1292 e578b58.exe 8 PID 1292 wrote to memory of 768 1292 e578b58.exe 9 PID 1292 wrote to memory of 380 1292 e578b58.exe 13 PID 1292 wrote to memory of 2868 1292 e578b58.exe 49 PID 1292 wrote to memory of 2888 1292 e578b58.exe 50 PID 1292 wrote to memory of 3016 1292 e578b58.exe 52 PID 1292 wrote to memory of 3432 1292 e578b58.exe 56 PID 1292 wrote to memory of 3564 1292 e578b58.exe 57 PID 1292 wrote to memory of 3784 1292 e578b58.exe 58 PID 1292 wrote to memory of 3884 1292 e578b58.exe 59 PID 1292 wrote to memory of 3952 1292 e578b58.exe 60 PID 1292 wrote to memory of 4040 1292 e578b58.exe 61 PID 1292 wrote to memory of 4224 1292 e578b58.exe 62 PID 1292 wrote to memory of 4880 1292 e578b58.exe 74 PID 1292 wrote to memory of 1984 1292 e578b58.exe 76 PID 1292 wrote to memory of 2976 1292 e578b58.exe 84 PID 1292 wrote to memory of 2976 1292 e578b58.exe 84 PID 1292 wrote to memory of 2448 1292 e578b58.exe 85 PID 1292 wrote to memory of 2448 1292 e578b58.exe 85 PID 1292 wrote to memory of 4296 1292 e578b58.exe 86 PID 1292 wrote to memory of 4296 1292 e578b58.exe 86 PID 4296 wrote to memory of 760 4296 e57a6cf.exe 8 PID 4296 wrote to memory of 768 4296 e57a6cf.exe 9 PID 4296 wrote to memory of 380 4296 e57a6cf.exe 13 PID 4296 wrote to memory of 2868 4296 e57a6cf.exe 49 PID 4296 wrote to memory of 2888 4296 e57a6cf.exe 50 PID 4296 wrote to memory of 3016 4296 e57a6cf.exe 52 PID 4296 wrote to memory of 3432 4296 e57a6cf.exe 56 PID 4296 wrote to memory of 3564 4296 e57a6cf.exe 57 PID 4296 wrote to memory of 3784 4296 e57a6cf.exe 58 PID 4296 wrote to memory of 3884 4296 e57a6cf.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a6cf.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2888
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3016
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\e578b58.exeC:\Users\Admin\AppData\Local\Temp\e578b58.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\e578caf.exeC:\Users\Admin\AppData\Local\Temp\e578caf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\e57a6bf.exeC:\Users\Admin\AppData\Local\Temp\e57a6bf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\e57a6cf.exeC:\Users\Admin\AppData\Local\Temp\e57a6cf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4296
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3564
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3784
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3952
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4224
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4880
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1984
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD503c23d8729858a25f586e80e63f70e3b
SHA13cf7a5faa8c5c3b4a5b584f6329412bf1a6f364e
SHA25604a4c9b770f2db3c798fe537bef3195e8d35639811e790940d53450cd9ebcf24
SHA5124d387bf17e7703c56b4e2e35c0688c92137750868b41a69a13c9c339c696ce2e85a3ecb2603203a2dcd6c1648fa5ec1bd63e75b12d43d85ddc8b314960e5bb9b
-
Filesize
256B
MD570b8e2a661a8b43a58a5b35f1fb7da02
SHA1b75fbe13c10673068044a194b48a15f5404869e0
SHA256124650b6266aea12aa596b09b68394d84567585f59a1c198b3be067c18f423f5
SHA512e47957fb6256a54263330a505256cb5f58370c880e75d256b9a7dcc23df86ee0df6959dfe52c22e1e76d25c910e798d9c698a1c7314e0e7edfa2e787d05abfec