Analysis
-
max time kernel
95s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3536369c6040cfbe451ce4ceaf3121e269c75d21f41fb6c451edcea9f67bddc2N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
3536369c6040cfbe451ce4ceaf3121e269c75d21f41fb6c451edcea9f67bddc2N.dll
-
Size
120KB
-
MD5
57b0e5e089cbe37c058600a6c0bac490
-
SHA1
43b134b9dbc3a7e3585a0d1dfc83910d7425ce43
-
SHA256
3536369c6040cfbe451ce4ceaf3121e269c75d21f41fb6c451edcea9f67bddc2
-
SHA512
eb94229c45098bebd7b1a5267bdc9bfe104e320772993c98f4291eb4f9fec47409769db884b97b98ad9ed334689c5f44f0e3a09bec946f987a68932e48ddc55c
-
SSDEEP
1536:mIWEvHB3H7Ny7hbzvB4YjMq6tuUOTYNWSKT81l6sP4jN6pG9ZlxED:mIWsdZwhbLB1pWuUOT/hTSDuTb0D
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578647.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57885a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578647.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57885a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a1ed.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a1ed.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57885a.exe -
Executes dropped EXE 4 IoCs
pid Process 2260 e578647.exe 3012 e57885a.exe 2332 e57a1ce.exe 4280 e57a1ed.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578647.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57885a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578647.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a1ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578647.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a1ed.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e578647.exe File opened (read-only) \??\J: e578647.exe File opened (read-only) \??\L: e578647.exe File opened (read-only) \??\E: e578647.exe File opened (read-only) \??\Q: e578647.exe File opened (read-only) \??\S: e578647.exe File opened (read-only) \??\O: e578647.exe File opened (read-only) \??\I: e578647.exe File opened (read-only) \??\K: e578647.exe File opened (read-only) \??\N: e578647.exe File opened (read-only) \??\P: e578647.exe File opened (read-only) \??\G: e578647.exe File opened (read-only) \??\R: e578647.exe File opened (read-only) \??\T: e578647.exe File opened (read-only) \??\M: e578647.exe -
resource yara_rule behavioral2/memory/2260-6-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-9-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-12-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-14-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-15-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-21-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-13-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-11-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-8-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-10-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-35-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-36-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-37-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-38-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-39-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-41-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-42-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-54-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-60-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-62-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-63-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-64-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-79-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-82-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-84-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-85-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-87-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-93-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-94-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-95-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-100-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-103-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2260-105-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3012-134-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/3012-147-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e578647.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e578647.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e578647.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578647.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e578647.exe File created C:\Windows\e57d6c8 e57885a.exe File created C:\Windows\e57f07a e57a1ed.exe File created C:\Windows\e5786a5 e578647.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a1ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578647.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57885a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a1ce.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2260 e578647.exe 2260 e578647.exe 2260 e578647.exe 2260 e578647.exe 3012 e57885a.exe 3012 e57885a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe Token: SeDebugPrivilege 2260 e578647.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 2640 4612 rundll32.exe 82 PID 4612 wrote to memory of 2640 4612 rundll32.exe 82 PID 4612 wrote to memory of 2640 4612 rundll32.exe 82 PID 2640 wrote to memory of 2260 2640 rundll32.exe 83 PID 2640 wrote to memory of 2260 2640 rundll32.exe 83 PID 2640 wrote to memory of 2260 2640 rundll32.exe 83 PID 2260 wrote to memory of 768 2260 e578647.exe 8 PID 2260 wrote to memory of 772 2260 e578647.exe 9 PID 2260 wrote to memory of 64 2260 e578647.exe 13 PID 2260 wrote to memory of 2876 2260 e578647.exe 49 PID 2260 wrote to memory of 2928 2260 e578647.exe 51 PID 2260 wrote to memory of 2104 2260 e578647.exe 52 PID 2260 wrote to memory of 3356 2260 e578647.exe 55 PID 2260 wrote to memory of 3520 2260 e578647.exe 57 PID 2260 wrote to memory of 3708 2260 e578647.exe 58 PID 2260 wrote to memory of 3800 2260 e578647.exe 59 PID 2260 wrote to memory of 3888 2260 e578647.exe 60 PID 2260 wrote to memory of 3992 2260 e578647.exe 61 PID 2260 wrote to memory of 3540 2260 e578647.exe 62 PID 2260 wrote to memory of 2180 2260 e578647.exe 64 PID 2260 wrote to memory of 4364 2260 e578647.exe 76 PID 2260 wrote to memory of 4612 2260 e578647.exe 81 PID 2260 wrote to memory of 2640 2260 e578647.exe 82 PID 2260 wrote to memory of 2640 2260 e578647.exe 82 PID 2640 wrote to memory of 3012 2640 rundll32.exe 84 PID 2640 wrote to memory of 3012 2640 rundll32.exe 84 PID 2640 wrote to memory of 3012 2640 rundll32.exe 84 PID 2640 wrote to memory of 2332 2640 rundll32.exe 85 PID 2640 wrote to memory of 2332 2640 rundll32.exe 85 PID 2640 wrote to memory of 2332 2640 rundll32.exe 85 PID 2640 wrote to memory of 4280 2640 rundll32.exe 86 PID 2640 wrote to memory of 4280 2640 rundll32.exe 86 PID 2640 wrote to memory of 4280 2640 rundll32.exe 86 PID 2260 wrote to memory of 768 2260 e578647.exe 8 PID 2260 wrote to memory of 772 2260 e578647.exe 9 PID 2260 wrote to memory of 64 2260 e578647.exe 13 PID 2260 wrote to memory of 2876 2260 e578647.exe 49 PID 2260 wrote to memory of 2928 2260 e578647.exe 51 PID 2260 wrote to memory of 2104 2260 e578647.exe 52 PID 2260 wrote to memory of 3356 2260 e578647.exe 55 PID 2260 wrote to memory of 3520 2260 e578647.exe 57 PID 2260 wrote to memory of 3708 2260 e578647.exe 58 PID 2260 wrote to memory of 3800 2260 e578647.exe 59 PID 2260 wrote to memory of 3888 2260 e578647.exe 60 PID 2260 wrote to memory of 3992 2260 e578647.exe 61 PID 2260 wrote to memory of 3540 2260 e578647.exe 62 PID 2260 wrote to memory of 2180 2260 e578647.exe 64 PID 2260 wrote to memory of 4364 2260 e578647.exe 76 PID 2260 wrote to memory of 3012 2260 e578647.exe 84 PID 2260 wrote to memory of 3012 2260 e578647.exe 84 PID 2260 wrote to memory of 2332 2260 e578647.exe 85 PID 2260 wrote to memory of 2332 2260 e578647.exe 85 PID 2260 wrote to memory of 4280 2260 e578647.exe 86 PID 2260 wrote to memory of 4280 2260 e578647.exe 86 PID 3012 wrote to memory of 768 3012 e57885a.exe 8 PID 3012 wrote to memory of 772 3012 e57885a.exe 9 PID 3012 wrote to memory of 64 3012 e57885a.exe 13 PID 3012 wrote to memory of 2876 3012 e57885a.exe 49 PID 3012 wrote to memory of 2928 3012 e57885a.exe 51 PID 3012 wrote to memory of 2104 3012 e57885a.exe 52 PID 3012 wrote to memory of 3356 3012 e57885a.exe 55 PID 3012 wrote to memory of 3520 3012 e57885a.exe 57 PID 3012 wrote to memory of 3708 3012 e57885a.exe 58 PID 3012 wrote to memory of 3800 3012 e57885a.exe 59 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57885a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a1ed.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2928
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2104
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3356
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3536369c6040cfbe451ce4ceaf3121e269c75d21f41fb6c451edcea9f67bddc2N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3536369c6040cfbe451ce4ceaf3121e269c75d21f41fb6c451edcea9f67bddc2N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\e578647.exeC:\Users\Admin\AppData\Local\Temp\e578647.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2260
-
-
C:\Users\Admin\AppData\Local\Temp\e57885a.exeC:\Users\Admin\AppData\Local\Temp\e57885a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\e57a1ce.exeC:\Users\Admin\AppData\Local\Temp\e57a1ce.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\e57a1ed.exeC:\Users\Admin\AppData\Local\Temp\e57a1ed.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:4280
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3520
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3708
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3800
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3540
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2180
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4364
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD53fb014a1991f47b88462414ca279fbbb
SHA16ae6b96857836f2aa1c65e5d4f02740388611307
SHA2565f45750ec05f6d3f87749421519653a9a43ecc2a2fa67a3e8624dccaa01d8fec
SHA512394fe7c4e1f24c7c1f0c76c296d2cf4207c519163a482522be9f71ed929cfde80efc4a54fc583e8de858a27b10b92efb6cad497bcfe511f41b9555d2e6c1164c
-
Filesize
256B
MD5a12acad0aaa358692b4d319e210479af
SHA1ffabd9d91a9566bc16bf374a9443caef56278ea1
SHA25696de1f4939582d6d9bd95736eeb25a1a2e82fa7c57792ea00ef8f3d1e44df4d5
SHA512148bdb75776ec1bd9e7e368ae56b4978454c38a393af0d1f12e5af8c955fbc212266bbdfea3e81c8889f78392e4c5a11af11046c8ceb9dd913d3ca87acf2586d