Analysis
-
max time kernel
32s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 22:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f720eec438f34d61725c39bb43bf889b1d9cd2d2dd5a1cbd33e3c4be00f4cdb.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
5f720eec438f34d61725c39bb43bf889b1d9cd2d2dd5a1cbd33e3c4be00f4cdb.dll
-
Size
120KB
-
MD5
d5e8a734e669cfdbd39ee8a18fca8263
-
SHA1
7b0333cee3242aa01233ffe32ff2bed3d82ccfc4
-
SHA256
5f720eec438f34d61725c39bb43bf889b1d9cd2d2dd5a1cbd33e3c4be00f4cdb
-
SHA512
b2802d7b7e86699523fd2cdd1aad913268660bf3d51b6cd9ff2e8763e5311c75cad895cb35ccac47acfa939f01f7bcffc54bdf76c70c2c4d51d297496a3a5816
-
SSDEEP
1536:cQaEvFtfCvdf8r/mH2CNFNPKgyWG4QhDPvPolIg8Hu8ouaO489iXuR/dTReK53Dd:Aot6dUrenKjWQhDRg8O8MKiKdesYPi
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57e445.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57e445.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b21a.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e445.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e445.exe -
Executes dropped EXE 4 IoCs
pid Process 1016 e57b21a.exe 1496 e57b371.exe 3100 e57e445.exe 4524 e57e484.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b21a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e445.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b21a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b21a.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57b21a.exe File opened (read-only) \??\I: e57b21a.exe File opened (read-only) \??\J: e57b21a.exe File opened (read-only) \??\M: e57b21a.exe File opened (read-only) \??\I: e57e445.exe File opened (read-only) \??\G: e57b21a.exe File opened (read-only) \??\H: e57b21a.exe File opened (read-only) \??\K: e57b21a.exe File opened (read-only) \??\L: e57b21a.exe File opened (read-only) \??\E: e57e445.exe File opened (read-only) \??\G: e57e445.exe File opened (read-only) \??\H: e57e445.exe -
resource yara_rule behavioral2/memory/1016-6-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-15-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-16-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-21-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-27-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-33-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-34-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-35-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-45-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-46-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-63-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-64-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-65-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-66-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-68-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-75-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-76-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1016-81-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/3100-107-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3100-123-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3100-163-0x0000000000840000-0x00000000018FA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57b268 e57b21a.exe File opened for modification C:\Windows\SYSTEM.INI e57b21a.exe File created C:\Windows\e580b94 e57e445.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57e445.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57e484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b21a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b371.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1016 e57b21a.exe 1016 e57b21a.exe 1016 e57b21a.exe 1016 e57b21a.exe 3100 e57e445.exe 3100 e57e445.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe Token: SeDebugPrivilege 1016 e57b21a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2196 2412 rundll32.exe 83 PID 2412 wrote to memory of 2196 2412 rundll32.exe 83 PID 2412 wrote to memory of 2196 2412 rundll32.exe 83 PID 2196 wrote to memory of 1016 2196 rundll32.exe 84 PID 2196 wrote to memory of 1016 2196 rundll32.exe 84 PID 2196 wrote to memory of 1016 2196 rundll32.exe 84 PID 1016 wrote to memory of 792 1016 e57b21a.exe 9 PID 1016 wrote to memory of 800 1016 e57b21a.exe 10 PID 1016 wrote to memory of 372 1016 e57b21a.exe 13 PID 1016 wrote to memory of 2584 1016 e57b21a.exe 44 PID 1016 wrote to memory of 2664 1016 e57b21a.exe 45 PID 1016 wrote to memory of 2808 1016 e57b21a.exe 47 PID 1016 wrote to memory of 3508 1016 e57b21a.exe 56 PID 1016 wrote to memory of 3640 1016 e57b21a.exe 57 PID 1016 wrote to memory of 3824 1016 e57b21a.exe 58 PID 1016 wrote to memory of 3928 1016 e57b21a.exe 59 PID 1016 wrote to memory of 3988 1016 e57b21a.exe 60 PID 1016 wrote to memory of 4072 1016 e57b21a.exe 61 PID 1016 wrote to memory of 3516 1016 e57b21a.exe 62 PID 1016 wrote to memory of 3068 1016 e57b21a.exe 75 PID 1016 wrote to memory of 2796 1016 e57b21a.exe 76 PID 1016 wrote to memory of 5000 1016 e57b21a.exe 81 PID 1016 wrote to memory of 2412 1016 e57b21a.exe 82 PID 1016 wrote to memory of 2196 1016 e57b21a.exe 83 PID 1016 wrote to memory of 2196 1016 e57b21a.exe 83 PID 2196 wrote to memory of 1496 2196 rundll32.exe 85 PID 2196 wrote to memory of 1496 2196 rundll32.exe 85 PID 2196 wrote to memory of 1496 2196 rundll32.exe 85 PID 1016 wrote to memory of 792 1016 e57b21a.exe 9 PID 1016 wrote to memory of 800 1016 e57b21a.exe 10 PID 1016 wrote to memory of 372 1016 e57b21a.exe 13 PID 1016 wrote to memory of 2584 1016 e57b21a.exe 44 PID 1016 wrote to memory of 2664 1016 e57b21a.exe 45 PID 1016 wrote to memory of 2808 1016 e57b21a.exe 47 PID 1016 wrote to memory of 3508 1016 e57b21a.exe 56 PID 1016 wrote to memory of 3640 1016 e57b21a.exe 57 PID 1016 wrote to memory of 3824 1016 e57b21a.exe 58 PID 1016 wrote to memory of 3928 1016 e57b21a.exe 59 PID 1016 wrote to memory of 3988 1016 e57b21a.exe 60 PID 1016 wrote to memory of 4072 1016 e57b21a.exe 61 PID 1016 wrote to memory of 3516 1016 e57b21a.exe 62 PID 1016 wrote to memory of 3068 1016 e57b21a.exe 75 PID 1016 wrote to memory of 2796 1016 e57b21a.exe 76 PID 1016 wrote to memory of 5000 1016 e57b21a.exe 81 PID 1016 wrote to memory of 2412 1016 e57b21a.exe 82 PID 1016 wrote to memory of 1496 1016 e57b21a.exe 85 PID 1016 wrote to memory of 1496 1016 e57b21a.exe 85 PID 2196 wrote to memory of 3100 2196 rundll32.exe 87 PID 2196 wrote to memory of 3100 2196 rundll32.exe 87 PID 2196 wrote to memory of 3100 2196 rundll32.exe 87 PID 2196 wrote to memory of 4524 2196 rundll32.exe 88 PID 2196 wrote to memory of 4524 2196 rundll32.exe 88 PID 2196 wrote to memory of 4524 2196 rundll32.exe 88 PID 3100 wrote to memory of 792 3100 e57e445.exe 9 PID 3100 wrote to memory of 800 3100 e57e445.exe 10 PID 3100 wrote to memory of 372 3100 e57e445.exe 13 PID 3100 wrote to memory of 2584 3100 e57e445.exe 44 PID 3100 wrote to memory of 2664 3100 e57e445.exe 45 PID 3100 wrote to memory of 2808 3100 e57e445.exe 47 PID 3100 wrote to memory of 3508 3100 e57e445.exe 56 PID 3100 wrote to memory of 3640 3100 e57e445.exe 57 PID 3100 wrote to memory of 3824 3100 e57e445.exe 58 PID 3100 wrote to memory of 3928 3100 e57e445.exe 59 PID 3100 wrote to memory of 3988 3100 e57e445.exe 60 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b21a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e445.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:372
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2664
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2808
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3508
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f720eec438f34d61725c39bb43bf889b1d9cd2d2dd5a1cbd33e3c4be00f4cdb.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f720eec438f34d61725c39bb43bf889b1d9cd2d2dd5a1cbd33e3c4be00f4cdb.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\e57b21a.exeC:\Users\Admin\AppData\Local\Temp\e57b21a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\e57b371.exeC:\Users\Admin\AppData\Local\Temp\e57b371.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\e57e445.exeC:\Users\Admin\AppData\Local\Temp\e57e445.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\e57e484.exeC:\Users\Admin\AppData\Local\Temp\e57e484.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3640
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3988
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4072
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3516
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2796
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5000
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5f8cb761e708512bfabbb91187732c8e3
SHA1137dd4f16af05a1cadd49ef21b648af9766fec21
SHA2566de718372ca785b65cfd2bddf6d64fde0acf5ea4c130d182f489cccd4b5631f0
SHA512fb4aeab14962a80ef90b4d1c6b41d3277bca67204a886f8b1e3ae9f1da8a9b419fb6e5b178ef9fdbb1b36db47dd6d260808275bacbaedbca4b140f6f8a7ec58e
-
Filesize
257B
MD5980050c4053de8a697948617c8845500
SHA1fb7aecc420d4551eefd0682ae4d3f4d1ce52b690
SHA2569c3a222dbd6c3b71721fdc4ba1c4093acc8334926eace8f8218ff22f831615c1
SHA5128cc8efd0e999d83bc4bc10c2f7cd0caf90c2e636004adab7e3e18d77951e51105cb3cb9d5f52b3d2c888c2bf9ffd103170a4d1e8f17c4f5b7e5d5149143984a2