Analysis
-
max time kernel
97s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 13:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
General
-
Target
678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll
-
Size
120KB
-
MD5
8110b6d591402fbd4a3db406b67d6a92
-
SHA1
b283410dad0aa1724261b6d6e68ffab0d264fc92
-
SHA256
678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992
-
SHA512
121665158f89fbda9b421275720f647cf85da34d81c6ec17d2730bf32c231046f51b2137a7ea8bb5608c145e06780b8b59a01bba2d1146aebb39f658056855dc
-
SSDEEP
1536:48mBsobH7Py8kFWQPbg09WkAniKUqJUnmcfEv/yh17qV+pIQcl0VmZPSVp:4XsZNFW+gcWqqJ4sCn7qsIZ/ZqX
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a690.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a690.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57cddf.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cddf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cddf.exe -
Executes dropped EXE 4 IoCs
pid Process 468 e57a690.exe 4088 e57a7f8.exe 32 e57cdcf.exe 2288 e57cddf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cddf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a690.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57cddf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cddf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cddf.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: e57a690.exe File opened (read-only) \??\H: e57a690.exe File opened (read-only) \??\I: e57a690.exe File opened (read-only) \??\N: e57a690.exe File opened (read-only) \??\O: e57a690.exe File opened (read-only) \??\H: e57cddf.exe File opened (read-only) \??\E: e57a690.exe File opened (read-only) \??\J: e57a690.exe File opened (read-only) \??\E: e57cddf.exe File opened (read-only) \??\I: e57cddf.exe File opened (read-only) \??\G: e57a690.exe File opened (read-only) \??\L: e57a690.exe File opened (read-only) \??\M: e57a690.exe File opened (read-only) \??\G: e57cddf.exe File opened (read-only) \??\K: e57a690.exe -
resource yara_rule behavioral2/memory/468-10-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-8-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-12-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-11-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-23-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-13-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-31-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-32-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-35-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-9-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-36-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-37-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-38-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-39-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-40-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-42-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-55-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-71-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-73-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-74-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-76-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-77-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-80-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-84-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-85-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-95-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/468-97-0x0000000000730000-0x00000000017EA000-memory.dmp upx behavioral2/memory/4088-120-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/2288-136-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/2288-173-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57a690.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57a690.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57a690.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57a70d e57a690.exe File opened for modification C:\Windows\SYSTEM.INI e57a690.exe File created C:\Windows\e57f86a e57cddf.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a690.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a7f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cddf.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 468 e57a690.exe 468 e57a690.exe 468 e57a690.exe 468 e57a690.exe 2288 e57cddf.exe 2288 e57cddf.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe Token: SeDebugPrivilege 468 e57a690.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 4612 388 rundll32.exe 82 PID 388 wrote to memory of 4612 388 rundll32.exe 82 PID 388 wrote to memory of 4612 388 rundll32.exe 82 PID 4612 wrote to memory of 468 4612 rundll32.exe 83 PID 4612 wrote to memory of 468 4612 rundll32.exe 83 PID 4612 wrote to memory of 468 4612 rundll32.exe 83 PID 468 wrote to memory of 780 468 e57a690.exe 8 PID 468 wrote to memory of 788 468 e57a690.exe 9 PID 468 wrote to memory of 60 468 e57a690.exe 13 PID 468 wrote to memory of 2880 468 e57a690.exe 49 PID 468 wrote to memory of 2888 468 e57a690.exe 50 PID 468 wrote to memory of 3008 468 e57a690.exe 51 PID 468 wrote to memory of 3440 468 e57a690.exe 56 PID 468 wrote to memory of 3568 468 e57a690.exe 57 PID 468 wrote to memory of 3752 468 e57a690.exe 58 PID 468 wrote to memory of 3840 468 e57a690.exe 59 PID 468 wrote to memory of 3908 468 e57a690.exe 60 PID 468 wrote to memory of 3992 468 e57a690.exe 61 PID 468 wrote to memory of 4144 468 e57a690.exe 62 PID 468 wrote to memory of 3372 468 e57a690.exe 75 PID 468 wrote to memory of 3424 468 e57a690.exe 76 PID 468 wrote to memory of 388 468 e57a690.exe 81 PID 468 wrote to memory of 4612 468 e57a690.exe 82 PID 468 wrote to memory of 4612 468 e57a690.exe 82 PID 4612 wrote to memory of 4088 4612 rundll32.exe 84 PID 4612 wrote to memory of 4088 4612 rundll32.exe 84 PID 4612 wrote to memory of 4088 4612 rundll32.exe 84 PID 4612 wrote to memory of 32 4612 rundll32.exe 85 PID 4612 wrote to memory of 32 4612 rundll32.exe 85 PID 4612 wrote to memory of 32 4612 rundll32.exe 85 PID 4612 wrote to memory of 2288 4612 rundll32.exe 86 PID 4612 wrote to memory of 2288 4612 rundll32.exe 86 PID 4612 wrote to memory of 2288 4612 rundll32.exe 86 PID 468 wrote to memory of 780 468 e57a690.exe 8 PID 468 wrote to memory of 788 468 e57a690.exe 9 PID 468 wrote to memory of 60 468 e57a690.exe 13 PID 468 wrote to memory of 2880 468 e57a690.exe 49 PID 468 wrote to memory of 2888 468 e57a690.exe 50 PID 468 wrote to memory of 3008 468 e57a690.exe 51 PID 468 wrote to memory of 3440 468 e57a690.exe 56 PID 468 wrote to memory of 3568 468 e57a690.exe 57 PID 468 wrote to memory of 3752 468 e57a690.exe 58 PID 468 wrote to memory of 3840 468 e57a690.exe 59 PID 468 wrote to memory of 3908 468 e57a690.exe 60 PID 468 wrote to memory of 3992 468 e57a690.exe 61 PID 468 wrote to memory of 4144 468 e57a690.exe 62 PID 468 wrote to memory of 3372 468 e57a690.exe 75 PID 468 wrote to memory of 3424 468 e57a690.exe 76 PID 468 wrote to memory of 4088 468 e57a690.exe 84 PID 468 wrote to memory of 4088 468 e57a690.exe 84 PID 468 wrote to memory of 32 468 e57a690.exe 85 PID 468 wrote to memory of 32 468 e57a690.exe 85 PID 468 wrote to memory of 2288 468 e57a690.exe 86 PID 468 wrote to memory of 2288 468 e57a690.exe 86 PID 2288 wrote to memory of 780 2288 e57cddf.exe 8 PID 2288 wrote to memory of 788 2288 e57cddf.exe 9 PID 2288 wrote to memory of 60 2288 e57cddf.exe 13 PID 2288 wrote to memory of 2880 2288 e57cddf.exe 49 PID 2288 wrote to memory of 2888 2288 e57cddf.exe 50 PID 2288 wrote to memory of 3008 2288 e57cddf.exe 51 PID 2288 wrote to memory of 3440 2288 e57cddf.exe 56 PID 2288 wrote to memory of 3568 2288 e57cddf.exe 57 PID 2288 wrote to memory of 3752 2288 e57cddf.exe 58 PID 2288 wrote to memory of 3840 2288 e57cddf.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a690.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cddf.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2880
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2888
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3008
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\e57a690.exeC:\Users\Admin\AppData\Local\Temp\e57a690.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\e57a7f8.exeC:\Users\Admin\AppData\Local\Temp\e57a7f8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4088
-
-
C:\Users\Admin\AppData\Local\Temp\e57cdcf.exeC:\Users\Admin\AppData\Local\Temp\e57cdcf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:32
-
-
C:\Users\Admin\AppData\Local\Temp\e57cddf.exeC:\Users\Admin\AppData\Local\Temp\e57cddf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2288
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4144
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3372
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3424
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5f1b9ad7b3d076e04c2d9873e38d49fad
SHA18f50ed098ef2acb52d4464ca5992fae00c5e006b
SHA256b7c7a289ae5f5d6d2de70019caf81290178023d97d23b75eee8994b47ef42f58
SHA5121f0de85cdc7f7c5774d0103d4517df293bb1e83becae7b45cb122412b2c168fc37d535dc8e01ef372e481d990f6c679d48a36a29a0f4d320b1fc62546a3220d6
-
Filesize
257B
MD5346d03e4453b5e563b0219c0dc03f051
SHA1e526efdbef251cb7504fba149e54ebf993c52ca8
SHA25643d3f939da01324ff427277b1abc27c026501b667657766bd5aef1e6f3a6fc00
SHA512e6fbed940da7b45339556ecea952e5cf32d6fa8bb7ca6eea5782843479d6ee3dde657c8c34ac0ec40796df9095dd07ba9150c0b53dcd397df86de320073042f4