Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33d64b84bbc2839a55f708c8042ca88e7ab2ebe2535ee9d6209ce98f3a6fecae.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
33d64b84bbc2839a55f708c8042ca88e7ab2ebe2535ee9d6209ce98f3a6fecae.dll
-
Size
120KB
-
MD5
0966aa53b6e763170b066788a71a5ed2
-
SHA1
7171398ce4a828d49a1bec5e1026106eeb4dd606
-
SHA256
33d64b84bbc2839a55f708c8042ca88e7ab2ebe2535ee9d6209ce98f3a6fecae
-
SHA512
2ff1cbb50d8690f4f634465456b0fd768cafe10d0822aabeb0206058404322d39188720bd849638d48f2a972da1e9ca94a65bfae5ff5969c90b6695c786e5d23
-
SSDEEP
3072:9Desm00b7D3uMema1OVWRyYbXuB8Is9902zN8oPbG5RP:9y0avcOVW0H8DWoPbSRP
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76de3e.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76de3e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c0cf.exe -
Executes dropped EXE 3 IoCs
pid Process 2160 f76bf1b.exe 2732 f76c0cf.exe 2468 f76de3e.exe -
Loads dropped DLL 6 IoCs
pid Process 2164 rundll32.exe 2164 rundll32.exe 2164 rundll32.exe 2164 rundll32.exe 2164 rundll32.exe 2164 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76de3e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bf1b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bf1b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76de3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76de3e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76de3e.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: f76bf1b.exe File opened (read-only) \??\J: f76bf1b.exe File opened (read-only) \??\M: f76bf1b.exe File opened (read-only) \??\N: f76bf1b.exe File opened (read-only) \??\R: f76bf1b.exe File opened (read-only) \??\S: f76bf1b.exe File opened (read-only) \??\E: f76bf1b.exe File opened (read-only) \??\I: f76bf1b.exe File opened (read-only) \??\L: f76bf1b.exe File opened (read-only) \??\O: f76bf1b.exe File opened (read-only) \??\G: f76bf1b.exe File opened (read-only) \??\H: f76bf1b.exe File opened (read-only) \??\K: f76bf1b.exe File opened (read-only) \??\P: f76bf1b.exe -
resource yara_rule behavioral1/memory/2160-15-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-20-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-23-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-18-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-17-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-21-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-25-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-24-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-22-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-19-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-63-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-65-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-66-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-64-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-67-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-69-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-70-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-71-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-72-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-86-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-89-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-111-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2160-153-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2732-158-0x0000000000940000-0x00000000019FA000-memory.dmp upx behavioral1/memory/2732-191-0x0000000000940000-0x00000000019FA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f76bf97 f76bf1b.exe File opened for modification C:\Windows\SYSTEM.INI f76bf1b.exe File created C:\Windows\f770f9a f76c0cf.exe File created C:\Windows\f772c9c f76de3e.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bf1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c0cf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76de3e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2160 f76bf1b.exe 2160 f76bf1b.exe 2732 f76c0cf.exe 2468 f76de3e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2160 f76bf1b.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2732 f76c0cf.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe Token: SeDebugPrivilege 2468 f76de3e.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2164 1652 rundll32.exe 30 PID 1652 wrote to memory of 2164 1652 rundll32.exe 30 PID 1652 wrote to memory of 2164 1652 rundll32.exe 30 PID 1652 wrote to memory of 2164 1652 rundll32.exe 30 PID 1652 wrote to memory of 2164 1652 rundll32.exe 30 PID 1652 wrote to memory of 2164 1652 rundll32.exe 30 PID 1652 wrote to memory of 2164 1652 rundll32.exe 30 PID 2164 wrote to memory of 2160 2164 rundll32.exe 31 PID 2164 wrote to memory of 2160 2164 rundll32.exe 31 PID 2164 wrote to memory of 2160 2164 rundll32.exe 31 PID 2164 wrote to memory of 2160 2164 rundll32.exe 31 PID 2160 wrote to memory of 1112 2160 f76bf1b.exe 19 PID 2160 wrote to memory of 1160 2160 f76bf1b.exe 20 PID 2160 wrote to memory of 1196 2160 f76bf1b.exe 21 PID 2160 wrote to memory of 1496 2160 f76bf1b.exe 25 PID 2160 wrote to memory of 1652 2160 f76bf1b.exe 29 PID 2160 wrote to memory of 2164 2160 f76bf1b.exe 30 PID 2160 wrote to memory of 2164 2160 f76bf1b.exe 30 PID 2164 wrote to memory of 2732 2164 rundll32.exe 32 PID 2164 wrote to memory of 2732 2164 rundll32.exe 32 PID 2164 wrote to memory of 2732 2164 rundll32.exe 32 PID 2164 wrote to memory of 2732 2164 rundll32.exe 32 PID 2164 wrote to memory of 2468 2164 rundll32.exe 34 PID 2164 wrote to memory of 2468 2164 rundll32.exe 34 PID 2164 wrote to memory of 2468 2164 rundll32.exe 34 PID 2164 wrote to memory of 2468 2164 rundll32.exe 34 PID 2160 wrote to memory of 1112 2160 f76bf1b.exe 19 PID 2160 wrote to memory of 1160 2160 f76bf1b.exe 20 PID 2160 wrote to memory of 1196 2160 f76bf1b.exe 21 PID 2160 wrote to memory of 1496 2160 f76bf1b.exe 25 PID 2160 wrote to memory of 2732 2160 f76bf1b.exe 32 PID 2160 wrote to memory of 2732 2160 f76bf1b.exe 32 PID 2160 wrote to memory of 2468 2160 f76bf1b.exe 34 PID 2160 wrote to memory of 2468 2160 f76bf1b.exe 34 PID 2732 wrote to memory of 1112 2732 f76c0cf.exe 19 PID 2732 wrote to memory of 1160 2732 f76c0cf.exe 20 PID 2732 wrote to memory of 1196 2732 f76c0cf.exe 21 PID 2732 wrote to memory of 1496 2732 f76c0cf.exe 25 PID 2468 wrote to memory of 1112 2468 f76de3e.exe 19 PID 2468 wrote to memory of 1160 2468 f76de3e.exe 20 PID 2468 wrote to memory of 1196 2468 f76de3e.exe 21 PID 2468 wrote to memory of 1496 2468 f76de3e.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76de3e.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33d64b84bbc2839a55f708c8042ca88e7ab2ebe2535ee9d6209ce98f3a6fecae.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33d64b84bbc2839a55f708c8042ca88e7ab2ebe2535ee9d6209ce98f3a6fecae.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\f76bf1b.exeC:\Users\Admin\AppData\Local\Temp\f76bf1b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\f76c0cf.exeC:\Users\Admin\AppData\Local\Temp\f76c0cf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\f76de3e.exeC:\Users\Admin\AppData\Local\Temp\f76de3e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2468
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1496
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5e813f803c92895d59590f9bc43bf2bd8
SHA19e3185c2ee6c288dc27598253affd165b3eff071
SHA2569921e70b6e90739f5d4df6e07c87616c0ea8052dffdb041e4c8159a01f29da2b
SHA51277153d64ac9509854a7bfc1b1bf420f83a04119561ead4afef6cdb60dd38928e6b5ab3f33af5cedcf861b7b96e3bdc043a5502e2eb8b8061a824bd9251631ab1
-
Filesize
97KB
MD55f4efe687a63b71e499202b4204eb77a
SHA1dfd66f36a2eafa06a22eab5cfa8742a33a1cd6e9
SHA2562b349a5ee575c48887cb8a6f86f6b7cafef42ef62d8ced904db7e861e56394f8
SHA5128e3cd9cc47f5803edd0390cfb22d8652c6a017f4e130f5daeb78ff9a110a7072072b05603ace42d3023f27cb6ba81c07d1b1214043e38ee62d8f21d1bd3c9c87