Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 05:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe
-
Size
198KB
-
MD5
f0bf89f94304c4bea911dd6aaea91a30
-
SHA1
49f71a7a2591adb2264533ef2544936ef4476ba5
-
SHA256
2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97e
-
SHA512
6089c0b8cbe4eb15a3470e00d58cbe1bf48092bfffd0650f2458b34b18b4727b14d1f125e208e051b33fd82393bbde9ffdc4d6115999954b909d2e801d7781b6
-
SSDEEP
3072:YXLVpImRqLOUph/gDk8VUuXuWKZK36K7dQNq/oxnwX5c6LsXS5QRNd6:MLVpOj4Dk8+cu9Kq65HISoN
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\U: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\S: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\N: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\P: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\V: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\W: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\Y: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\Z: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\K: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\G: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\I: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\M: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\O: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\Q: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\R: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\X: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\E: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\J: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\L: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened (read-only) \??\H: 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened for modification F:\autorun.inf 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
resource yara_rule behavioral1/memory/2248-1-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-6-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-25-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-24-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-4-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-23-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-22-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-8-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-7-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-5-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-3-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-34-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-35-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-36-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-38-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-37-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-40-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-41-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-42-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-43-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-46-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-47-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-50-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-51-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-57-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-58-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-63-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-64-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-80-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx behavioral1/memory/2248-83-0x0000000001CA0000-0x0000000002D5A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe File created C:\Windows\f77e495 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe Token: SeDebugPrivilege 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 2068 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 30 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 2424 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 32 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1068 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 34 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 PID 2248 wrote to memory of 2996 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 36 PID 2248 wrote to memory of 1252 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 18 PID 2248 wrote to memory of 1348 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 19 PID 2248 wrote to memory of 1412 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 20 PID 2248 wrote to memory of 1264 2248 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe 22 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1252
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1348
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe"C:\Users\Admin\AppData\Local\Temp\2a913b68ff15563c3306d056056052e9532a254d2c3c0bcc5d97f73a35ccf97eN.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1264
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2068
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2424
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1068
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2996
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD58161ed681697ed1cd6200a8f0bcc5677
SHA1c89ca10e9e6ad30c154e76abcfeda47ef3c02637
SHA2562d8a2fe832264c2deafdd36fbcd65db51da7e7bbabd9290cb90f18e894a240ae
SHA512864738a74bed401d958ca938edfa8d9b49b777e517263c5941bce226bb883cd5a4119342501873cedbb84fdfc258c4401d5d037832802a04f2244f90c1c6192e