Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
General
-
Target
cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe
-
Size
964KB
-
MD5
32853a5f2ee1db3ac67456ca2b442aac
-
SHA1
ec72ab1282eb9d362a1c8ebc9f7d5e41a7574de7
-
SHA256
cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c
-
SHA512
a7a637b090b6b376cb3137a18e07d5f315bd1839a0a3d7a6e8a2de327a229a0fb81e9cc603d5ad92d5555916912b54c5d5bf98835afad17c5b93edaf52476b0c
-
SSDEEP
12288:dYsRHWAErYUy4vOx3Cnzo8eXj9p3XbMLm5ZR4NqavVQ0jBkDwhk7j:dYsRHWAQvwCnzo8aj0mqnCgO0k7j
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\N: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\P: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\Z: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\G: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\L: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\Q: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\T: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\U: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\E: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\I: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\J: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\M: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\O: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\R: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\V: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\K: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\S: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\W: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\X: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened (read-only) \??\Y: cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened for modification F:\autorun.inf cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
resource yara_rule behavioral2/memory/4900-1-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-3-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-7-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-6-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-15-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-4-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-16-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-5-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-18-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-20-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-21-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-23-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-22-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-24-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-25-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-26-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-29-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-30-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-31-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-33-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-34-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-38-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-40-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-41-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-44-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-46-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-53-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-55-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-57-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-59-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-62-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-64-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-66-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-67-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-69-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-71-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-73-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4900-75-0x00000000024B0000-0x000000000356A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e57c15c cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe File opened for modification C:\Windows\SYSTEM.INI cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserMachineCode\MachineGuid = "3BAE18A318A79E491A35EE8FDACD8AAF" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\BrowserMachineCode cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe Token: SeDebugPrivilege 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 780 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 8 PID 4900 wrote to memory of 784 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 9 PID 4900 wrote to memory of 316 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 13 PID 4900 wrote to memory of 2848 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 49 PID 4900 wrote to memory of 2904 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 50 PID 4900 wrote to memory of 3000 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 52 PID 4900 wrote to memory of 3444 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 56 PID 4900 wrote to memory of 3580 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 57 PID 4900 wrote to memory of 3744 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 58 PID 4900 wrote to memory of 3832 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 59 PID 4900 wrote to memory of 3900 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 60 PID 4900 wrote to memory of 4016 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 61 PID 4900 wrote to memory of 3968 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 62 PID 4900 wrote to memory of 2316 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 64 PID 4900 wrote to memory of 4952 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 76 PID 4900 wrote to memory of 4728 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 81 PID 4900 wrote to memory of 2848 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 49 PID 4900 wrote to memory of 2904 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 50 PID 4900 wrote to memory of 3000 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 52 PID 4900 wrote to memory of 3444 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 56 PID 4900 wrote to memory of 3580 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 57 PID 4900 wrote to memory of 3744 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 58 PID 4900 wrote to memory of 3832 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 59 PID 4900 wrote to memory of 3900 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 60 PID 4900 wrote to memory of 4016 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 61 PID 4900 wrote to memory of 3968 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 62 PID 4900 wrote to memory of 2316 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 64 PID 4900 wrote to memory of 4952 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 76 PID 4900 wrote to memory of 4728 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 81 PID 4900 wrote to memory of 2848 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 49 PID 4900 wrote to memory of 2904 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 50 PID 4900 wrote to memory of 3000 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 52 PID 4900 wrote to memory of 3444 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 56 PID 4900 wrote to memory of 3580 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 57 PID 4900 wrote to memory of 3744 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 58 PID 4900 wrote to memory of 3832 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 59 PID 4900 wrote to memory of 3900 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 60 PID 4900 wrote to memory of 4016 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 61 PID 4900 wrote to memory of 3968 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 62 PID 4900 wrote to memory of 2316 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 64 PID 4900 wrote to memory of 4952 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 76 PID 4900 wrote to memory of 2848 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 49 PID 4900 wrote to memory of 2904 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 50 PID 4900 wrote to memory of 3000 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 52 PID 4900 wrote to memory of 3444 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 56 PID 4900 wrote to memory of 3580 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 57 PID 4900 wrote to memory of 3744 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 58 PID 4900 wrote to memory of 3832 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 59 PID 4900 wrote to memory of 3900 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 60 PID 4900 wrote to memory of 4016 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 61 PID 4900 wrote to memory of 3968 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 62 PID 4900 wrote to memory of 2316 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 64 PID 4900 wrote to memory of 4952 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 76 PID 4900 wrote to memory of 2848 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 49 PID 4900 wrote to memory of 2904 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 50 PID 4900 wrote to memory of 3000 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 52 PID 4900 wrote to memory of 3444 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 56 PID 4900 wrote to memory of 3580 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 57 PID 4900 wrote to memory of 3744 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 58 PID 4900 wrote to memory of 3832 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 59 PID 4900 wrote to memory of 3900 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 60 PID 4900 wrote to memory of 4016 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 61 PID 4900 wrote to memory of 3968 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 62 PID 4900 wrote to memory of 2316 4900 cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe 64 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2904
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3000
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe"C:\Users\Admin\AppData\Local\Temp\cc22145655856303f1510a05ba6fa0dbc48341478206ba950028f1d7a5b4633c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4900
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3832
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3968
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2316
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4952
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4728
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD55170500b99fa537582be1959680e3885
SHA10830089cc3e77fddc727b00733144a32fcae65f1
SHA25626cf3f4f9faec3bac10f58a2f782fe488e9e480a74c555b5a8c8735ffbe13197
SHA5121a62bc57510f78858b429d8d3125db1485764d4e99ad0f37299806b7ff07f8bc146c65387f6eb5daaff62c9e73c2701f4cfa99cf927948647af52e41af59bb4c