Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a6e29a8f85e3a76c4cbef91ebc2fd1d80ebb70c16cb86bf86c144db38d65680.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
6a6e29a8f85e3a76c4cbef91ebc2fd1d80ebb70c16cb86bf86c144db38d65680.dll
-
Size
120KB
-
MD5
3d4dc18ecd26335b92ef78ba1ddf5e4f
-
SHA1
b58f14d05a9e97077acea58faf74b8cd34294c8e
-
SHA256
6a6e29a8f85e3a76c4cbef91ebc2fd1d80ebb70c16cb86bf86c144db38d65680
-
SHA512
5dc13e5861f83ee70c3ec8a41de5a6be4ab54bc4a2ce1dd8e31c4081fbe4c75a1dad7b4a97a82c0adc14d46632e49fa82784ea51065c8e6ac44eb6b1232f15bf
-
SSDEEP
3072:KCQAe5VA9gdWMFbrGNUwrDinS+MbsUQt1jt+djpH6/:KlAqA9M2NUwryfMbsUwZ+dF6/
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576457.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576707.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576457.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576707.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576457.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5780e8.exe -
Executes dropped EXE 4 IoCs
pid Process 1352 e576457.exe 4900 e576707.exe 1820 e5780b9.exe 1848 e5780e8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576707.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5780e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5780e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576457.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576707.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: e576457.exe File opened (read-only) \??\P: e576457.exe File opened (read-only) \??\G: e576457.exe File opened (read-only) \??\N: e576457.exe File opened (read-only) \??\R: e576457.exe File opened (read-only) \??\E: e576457.exe File opened (read-only) \??\I: e576457.exe File opened (read-only) \??\K: e576457.exe File opened (read-only) \??\L: e576457.exe File opened (read-only) \??\O: e576457.exe File opened (read-only) \??\Q: e576457.exe File opened (read-only) \??\H: e576457.exe File opened (read-only) \??\J: e576457.exe File opened (read-only) \??\S: e576457.exe -
resource yara_rule behavioral2/memory/1352-6-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-9-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-8-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-12-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-13-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-16-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-15-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-11-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-10-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-17-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-35-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-36-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-37-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-38-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-39-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-41-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-42-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-56-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-58-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-60-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-74-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-78-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-79-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-80-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-83-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-84-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-88-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-89-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-90-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-99-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1352-100-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/4900-131-0x0000000000BA0000-0x0000000001C5A000-memory.dmp upx behavioral2/memory/4900-149-0x0000000000BA0000-0x0000000001C5A000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e576457.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e576457.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e576457.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e576457.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e576457.exe File created C:\Windows\e57b594 e576707.exe File created C:\Windows\e57cf66 e5780e8.exe File created C:\Windows\e5764f4 e576457.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576457.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576707.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5780b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5780e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1352 e576457.exe 1352 e576457.exe 1352 e576457.exe 1352 e576457.exe 4900 e576707.exe 4900 e576707.exe 1848 e5780e8.exe 1848 e5780e8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe Token: SeDebugPrivilege 1352 e576457.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3976 wrote to memory of 3096 3976 rundll32.exe 83 PID 3976 wrote to memory of 3096 3976 rundll32.exe 83 PID 3976 wrote to memory of 3096 3976 rundll32.exe 83 PID 3096 wrote to memory of 1352 3096 rundll32.exe 84 PID 3096 wrote to memory of 1352 3096 rundll32.exe 84 PID 3096 wrote to memory of 1352 3096 rundll32.exe 84 PID 1352 wrote to memory of 776 1352 e576457.exe 8 PID 1352 wrote to memory of 784 1352 e576457.exe 9 PID 1352 wrote to memory of 336 1352 e576457.exe 13 PID 1352 wrote to memory of 2660 1352 e576457.exe 44 PID 1352 wrote to memory of 2680 1352 e576457.exe 45 PID 1352 wrote to memory of 2816 1352 e576457.exe 49 PID 1352 wrote to memory of 3496 1352 e576457.exe 56 PID 1352 wrote to memory of 3632 1352 e576457.exe 57 PID 1352 wrote to memory of 3820 1352 e576457.exe 58 PID 1352 wrote to memory of 3908 1352 e576457.exe 59 PID 1352 wrote to memory of 3968 1352 e576457.exe 60 PID 1352 wrote to memory of 4068 1352 e576457.exe 61 PID 1352 wrote to memory of 4064 1352 e576457.exe 62 PID 1352 wrote to memory of 1900 1352 e576457.exe 75 PID 1352 wrote to memory of 4596 1352 e576457.exe 76 PID 1352 wrote to memory of 3932 1352 e576457.exe 81 PID 1352 wrote to memory of 3976 1352 e576457.exe 82 PID 1352 wrote to memory of 3096 1352 e576457.exe 83 PID 1352 wrote to memory of 3096 1352 e576457.exe 83 PID 3096 wrote to memory of 4900 3096 rundll32.exe 85 PID 3096 wrote to memory of 4900 3096 rundll32.exe 85 PID 3096 wrote to memory of 4900 3096 rundll32.exe 85 PID 3096 wrote to memory of 1820 3096 rundll32.exe 86 PID 3096 wrote to memory of 1820 3096 rundll32.exe 86 PID 3096 wrote to memory of 1820 3096 rundll32.exe 86 PID 3096 wrote to memory of 1848 3096 rundll32.exe 87 PID 3096 wrote to memory of 1848 3096 rundll32.exe 87 PID 3096 wrote to memory of 1848 3096 rundll32.exe 87 PID 1352 wrote to memory of 776 1352 e576457.exe 8 PID 1352 wrote to memory of 784 1352 e576457.exe 9 PID 1352 wrote to memory of 336 1352 e576457.exe 13 PID 1352 wrote to memory of 2660 1352 e576457.exe 44 PID 1352 wrote to memory of 2680 1352 e576457.exe 45 PID 1352 wrote to memory of 2816 1352 e576457.exe 49 PID 1352 wrote to memory of 3496 1352 e576457.exe 56 PID 1352 wrote to memory of 3632 1352 e576457.exe 57 PID 1352 wrote to memory of 3820 1352 e576457.exe 58 PID 1352 wrote to memory of 3908 1352 e576457.exe 59 PID 1352 wrote to memory of 3968 1352 e576457.exe 60 PID 1352 wrote to memory of 4068 1352 e576457.exe 61 PID 1352 wrote to memory of 4064 1352 e576457.exe 62 PID 1352 wrote to memory of 1900 1352 e576457.exe 75 PID 1352 wrote to memory of 4596 1352 e576457.exe 76 PID 1352 wrote to memory of 4900 1352 e576457.exe 85 PID 1352 wrote to memory of 4900 1352 e576457.exe 85 PID 1352 wrote to memory of 1820 1352 e576457.exe 86 PID 1352 wrote to memory of 1820 1352 e576457.exe 86 PID 1352 wrote to memory of 1848 1352 e576457.exe 87 PID 1352 wrote to memory of 1848 1352 e576457.exe 87 PID 4900 wrote to memory of 776 4900 e576707.exe 8 PID 4900 wrote to memory of 784 4900 e576707.exe 9 PID 4900 wrote to memory of 336 4900 e576707.exe 13 PID 4900 wrote to memory of 2660 4900 e576707.exe 44 PID 4900 wrote to memory of 2680 4900 e576707.exe 45 PID 4900 wrote to memory of 2816 4900 e576707.exe 49 PID 4900 wrote to memory of 3496 4900 e576707.exe 56 PID 4900 wrote to memory of 3632 4900 e576707.exe 57 PID 4900 wrote to memory of 3820 4900 e576707.exe 58 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5780e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576707.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2680
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2816
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6e29a8f85e3a76c4cbef91ebc2fd1d80ebb70c16cb86bf86c144db38d65680.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6e29a8f85e3a76c4cbef91ebc2fd1d80ebb70c16cb86bf86c144db38d65680.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\e576457.exeC:\Users\Admin\AppData\Local\Temp\e576457.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1352
-
-
C:\Users\Admin\AppData\Local\Temp\e576707.exeC:\Users\Admin\AppData\Local\Temp\e576707.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\e5780b9.exeC:\Users\Admin\AppData\Local\Temp\e5780b9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\e5780e8.exeC:\Users\Admin\AppData\Local\Temp\e5780e8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1848
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3632
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3820
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3908
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3968
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4064
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1900
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4596
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3932
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3940
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5da69ca5fa5ad9154005a84eb1f37652e
SHA1ff1f3a4c03725e9c4fec817b0b3d2e6e7cfd2843
SHA256fd875d31dd683ddc87696d7a095524b859fc38e6782b5e5b9b2c1afb62555560
SHA512d1cfa412e3a5993ad072537073a6a99a4420daa7bede1c087d159a901b2c4980768ab3519f831d11da22fd3b6cc9897136f39577c30522f8c7db76bc486453c7
-
Filesize
257B
MD54bd6def0fcd5a8498f450cdcdbbd658f
SHA1e3beae00daccb16151a8d3eeac9a245cae0fed8b
SHA2562eb5b44c281a5d8214e22f34b6120ced659eeaf839539b0e652915d0c50fddf3
SHA512ba085f5cd32cd096a5b17395c64a2ae9e7a546c6f42c2f2a953f5bc4f153ca7d2ce46fe776f532d71d3847e8fdf2acc49ffa569c61fa8d6694b5f71a6b1c8d8f