Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 03:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5753322fa7728a12d505500d0cd27b92ba8ed75b9e3426b76ba8d32b59188d25N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
5753322fa7728a12d505500d0cd27b92ba8ed75b9e3426b76ba8d32b59188d25N.dll
-
Size
120KB
-
MD5
1cb3284b1bac179c3a71e82049064310
-
SHA1
798f505bcf9963214c30214bbe1e754ffd30c39c
-
SHA256
5753322fa7728a12d505500d0cd27b92ba8ed75b9e3426b76ba8d32b59188d25
-
SHA512
8b9887db9b61bcc3de62239cc3713f344c7a72eb522bee8e7023997a62c11b55a3b64f04ebb7a6399eef198c661e6708494f40e00c8343fbf07409d36a27a6f5
-
SSDEEP
3072:zjvWWeYkxd7aJpC4TSZKRcf37GCqH/slKw/dr:zvLEGpNeYRcf3KkKSV
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578472.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578472.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576978.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576978.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578472.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578472.exe -
Executes dropped EXE 4 IoCs
pid Process 2264 e576978.exe 3036 e576b2d.exe 3452 e578453.exe 1460 e578472.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578472.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576978.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578472.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e576978.exe File opened (read-only) \??\H: e576978.exe File opened (read-only) \??\J: e576978.exe File opened (read-only) \??\K: e576978.exe File opened (read-only) \??\L: e576978.exe File opened (read-only) \??\P: e576978.exe File opened (read-only) \??\G: e576978.exe File opened (read-only) \??\I: e576978.exe File opened (read-only) \??\R: e576978.exe File opened (read-only) \??\S: e576978.exe File opened (read-only) \??\O: e576978.exe File opened (read-only) \??\M: e576978.exe File opened (read-only) \??\N: e576978.exe File opened (read-only) \??\Q: e576978.exe File opened (read-only) \??\E: e578472.exe -
resource yara_rule behavioral2/memory/2264-6-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-9-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-10-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-11-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-26-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-15-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-14-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-13-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-31-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-36-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-35-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-37-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-39-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-38-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-41-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-42-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-56-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-59-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-60-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-75-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-76-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-79-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-81-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-83-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-85-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-87-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-90-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-92-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2264-100-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1460-126-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/1460-165-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e576978.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e576978.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e576978.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e576978.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e576a24 e576978.exe File opened for modification C:\Windows\SYSTEM.INI e576978.exe File created C:\Windows\e57bb61 e578472.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576978.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576b2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578453.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578472.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2264 e576978.exe 2264 e576978.exe 2264 e576978.exe 2264 e576978.exe 1460 e578472.exe 1460 e578472.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe Token: SeDebugPrivilege 2264 e576978.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 748 3032 rundll32.exe 83 PID 3032 wrote to memory of 748 3032 rundll32.exe 83 PID 3032 wrote to memory of 748 3032 rundll32.exe 83 PID 748 wrote to memory of 2264 748 rundll32.exe 84 PID 748 wrote to memory of 2264 748 rundll32.exe 84 PID 748 wrote to memory of 2264 748 rundll32.exe 84 PID 2264 wrote to memory of 756 2264 e576978.exe 8 PID 2264 wrote to memory of 764 2264 e576978.exe 9 PID 2264 wrote to memory of 316 2264 e576978.exe 13 PID 2264 wrote to memory of 2900 2264 e576978.exe 50 PID 2264 wrote to memory of 3056 2264 e576978.exe 52 PID 2264 wrote to memory of 916 2264 e576978.exe 53 PID 2264 wrote to memory of 3432 2264 e576978.exe 56 PID 2264 wrote to memory of 3568 2264 e576978.exe 57 PID 2264 wrote to memory of 3776 2264 e576978.exe 58 PID 2264 wrote to memory of 3864 2264 e576978.exe 59 PID 2264 wrote to memory of 3928 2264 e576978.exe 60 PID 2264 wrote to memory of 4012 2264 e576978.exe 61 PID 2264 wrote to memory of 432 2264 e576978.exe 62 PID 2264 wrote to memory of 4920 2264 e576978.exe 75 PID 2264 wrote to memory of 412 2264 e576978.exe 76 PID 2264 wrote to memory of 1488 2264 e576978.exe 81 PID 2264 wrote to memory of 3032 2264 e576978.exe 82 PID 2264 wrote to memory of 748 2264 e576978.exe 83 PID 2264 wrote to memory of 748 2264 e576978.exe 83 PID 748 wrote to memory of 3036 748 rundll32.exe 85 PID 748 wrote to memory of 3036 748 rundll32.exe 85 PID 748 wrote to memory of 3036 748 rundll32.exe 85 PID 748 wrote to memory of 3452 748 rundll32.exe 87 PID 748 wrote to memory of 3452 748 rundll32.exe 87 PID 748 wrote to memory of 3452 748 rundll32.exe 87 PID 748 wrote to memory of 1460 748 rundll32.exe 88 PID 748 wrote to memory of 1460 748 rundll32.exe 88 PID 748 wrote to memory of 1460 748 rundll32.exe 88 PID 2264 wrote to memory of 756 2264 e576978.exe 8 PID 2264 wrote to memory of 764 2264 e576978.exe 9 PID 2264 wrote to memory of 316 2264 e576978.exe 13 PID 2264 wrote to memory of 2900 2264 e576978.exe 50 PID 2264 wrote to memory of 3056 2264 e576978.exe 52 PID 2264 wrote to memory of 916 2264 e576978.exe 53 PID 2264 wrote to memory of 3432 2264 e576978.exe 56 PID 2264 wrote to memory of 3568 2264 e576978.exe 57 PID 2264 wrote to memory of 3776 2264 e576978.exe 58 PID 2264 wrote to memory of 3864 2264 e576978.exe 59 PID 2264 wrote to memory of 3928 2264 e576978.exe 60 PID 2264 wrote to memory of 4012 2264 e576978.exe 61 PID 2264 wrote to memory of 432 2264 e576978.exe 62 PID 2264 wrote to memory of 4920 2264 e576978.exe 75 PID 2264 wrote to memory of 412 2264 e576978.exe 76 PID 2264 wrote to memory of 3036 2264 e576978.exe 85 PID 2264 wrote to memory of 3036 2264 e576978.exe 85 PID 2264 wrote to memory of 3452 2264 e576978.exe 87 PID 2264 wrote to memory of 3452 2264 e576978.exe 87 PID 2264 wrote to memory of 1460 2264 e576978.exe 88 PID 2264 wrote to memory of 1460 2264 e576978.exe 88 PID 1460 wrote to memory of 756 1460 e578472.exe 8 PID 1460 wrote to memory of 764 1460 e578472.exe 9 PID 1460 wrote to memory of 316 1460 e578472.exe 13 PID 1460 wrote to memory of 2900 1460 e578472.exe 50 PID 1460 wrote to memory of 3056 1460 e578472.exe 52 PID 1460 wrote to memory of 916 1460 e578472.exe 53 PID 1460 wrote to memory of 3432 1460 e578472.exe 56 PID 1460 wrote to memory of 3568 1460 e578472.exe 57 PID 1460 wrote to memory of 3776 1460 e578472.exe 58 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576978.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578472.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:756
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3056
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:916
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5753322fa7728a12d505500d0cd27b92ba8ed75b9e3426b76ba8d32b59188d25N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5753322fa7728a12d505500d0cd27b92ba8ed75b9e3426b76ba8d32b59188d25N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\e576978.exeC:\Users\Admin\AppData\Local\Temp\e576978.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\e576b2d.exeC:\Users\Admin\AppData\Local\Temp\e576b2d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\e578453.exeC:\Users\Admin\AppData\Local\Temp\e578453.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\e578472.exeC:\Users\Admin\AppData\Local\Temp\e578472.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1460
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3928
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:432
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:412
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1488
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5a7b722975f7320311eeb52f3cbe4b2b5
SHA11cd2cf6c8b9bb0a496aeee4f2ce063e2bdb35d5f
SHA256cbd909acb7bd3fce9ee50b3d81abb22789d7fe2074f5530663d9a1348952c88c
SHA512ff0aeda868fb426774558cf622b1566dec0aff75833606521424f91029e4b4de95e401170038a7105cdd6e270108a2bc3a2de31760ff06f02aaef49a72a8bce1
-
Filesize
257B
MD568952ddcba0420efac59a3a98ca16d49
SHA1435a80aa4b80458450d07b427259d4086605b568
SHA25642a7807f9c981e42a2cf5436cf75845272279dd63865840420b009eee3c749bc
SHA51286b3564a2fe32cfc38e1623468478731b549793474b2f17d880a6b87ea4d88fad51f8befdb6c7cd08f80a8f86a757f9fd93f007e3f3ceab7276fca3e53ec39dc