Analysis
-
max time kernel
117s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
120 seconds
General
-
Target
2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe
-
Size
100KB
-
MD5
b1b57db70bdce0da313c4e81fe80b200
-
SHA1
3d8834f271f9174e26a1f846d95cb7af95fd18d2
-
SHA256
2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2d
-
SHA512
a049ded88fafca2069ea47125acd24e1f100ccc268c3e2bd7badf17d273c4e67c8da92bd9a5b50b2d3062086cd5eea79241ea65fb21f559cb834e44f76016e19
-
SSDEEP
1536:LTDSk5VN/n7ChnerRIAI0qRkxUKLcnsurli1RaZY80:dn7Wne1IxCpL2MTc
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\Z: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\E: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\H: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\Q: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\R: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\J: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\O: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\S: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\N: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\W: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\X: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\M: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\P: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\T: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\U: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\G: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\I: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\K: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\L: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened (read-only) \??\Y: 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened for modification F:\autorun.inf 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
resource yara_rule behavioral1/memory/2840-1-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-2-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-4-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-7-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-5-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-10-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-9-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-11-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-8-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-6-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-28-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-27-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-29-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-31-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-30-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-33-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-34-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-36-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-38-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-40-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-39-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-60-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-61-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-63-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-65-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-66-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx behavioral1/memory/2840-70-0x0000000001E60000-0x0000000002EEE000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe Token: SeDebugPrivilege 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 PID 2840 wrote to memory of 1116 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 19 PID 2840 wrote to memory of 1168 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 20 PID 2840 wrote to memory of 1212 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 21 PID 2840 wrote to memory of 848 2840 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe"C:\Users\Admin\AppData\Local\Temp\2789088c63f80fe4ac3951d26ebafb2419d11dc773882c3e3452ba76c4176c2dN.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2840
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:848
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD52c60aa6925e3d4237d83e11240094096
SHA1488fd11bb0be53e30411a8d1fa9a6815ccb4b587
SHA2564b23449c9d8c1808f72dc54fde2887436cec3f4eb7e30836fafd45ab83252f8f
SHA512e2820f7d6fb940df004bf375030a02a2b20f5a591bce37bcf167ef3202b7d6c44088a50998e59074da28db76362f6a57075e6d2828832b31cdb862950d04d234