Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 18:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
120 seconds
General
-
Target
8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll
-
Size
120KB
-
MD5
228e12d233cc773fb509ac9a9d58c9a0
-
SHA1
022875c8a951d5d686d61d58de1f11ad79cc62c9
-
SHA256
8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011c
-
SHA512
42dbf2714464dc30de95fe7138f788e1a236613b92727a30f988c9c90319674110016b9a2eb525ea741486bc34b9d279be87befb504108eaa0a36703022691d8
-
SSDEEP
3072:dCdRMWG/xIvmTtFZXXLFRaoJNAIfoZQwAalNTaqn49k:ORRG/GvO3LSovjalNTzni
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579933.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579933.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b4c9.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b4c9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b4c9.exe -
Executes dropped EXE 4 IoCs
pid Process 1456 e579933.exe 3520 e579a3c.exe 5112 e57b4b9.exe 4880 e57b4c9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b4c9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b4c9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b4c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b4c9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b4c9.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: e579933.exe File opened (read-only) \??\O: e579933.exe File opened (read-only) \??\Q: e579933.exe File opened (read-only) \??\S: e579933.exe File opened (read-only) \??\J: e579933.exe File opened (read-only) \??\R: e579933.exe File opened (read-only) \??\E: e57b4c9.exe File opened (read-only) \??\I: e579933.exe File opened (read-only) \??\G: e579933.exe File opened (read-only) \??\H: e579933.exe File opened (read-only) \??\T: e579933.exe File opened (read-only) \??\G: e57b4c9.exe File opened (read-only) \??\E: e579933.exe File opened (read-only) \??\L: e579933.exe File opened (read-only) \??\M: e579933.exe File opened (read-only) \??\P: e579933.exe File opened (read-only) \??\K: e579933.exe -
resource yara_rule behavioral2/memory/1456-25-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-26-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-27-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-33-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-12-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-10-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-11-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-8-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-9-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-35-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-37-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-38-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-39-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-40-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-41-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-43-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-44-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-57-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-59-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-60-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-74-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-75-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-78-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-80-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-83-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-85-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-87-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-88-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-89-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-90-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/1456-92-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/4880-138-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/1456-117-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/4880-169-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e579933.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e579933.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e579933.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e579933.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5799a0 e579933.exe File opened for modification C:\Windows\SYSTEM.INI e579933.exe File created C:\Windows\e57e9b4 e57b4c9.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579933.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579a3c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b4b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b4c9.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1456 e579933.exe 1456 e579933.exe 1456 e579933.exe 1456 e579933.exe 4880 e57b4c9.exe 4880 e57b4c9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe Token: SeDebugPrivilege 1456 e579933.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1368 1708 rundll32.exe 82 PID 1708 wrote to memory of 1368 1708 rundll32.exe 82 PID 1708 wrote to memory of 1368 1708 rundll32.exe 82 PID 1368 wrote to memory of 1456 1368 rundll32.exe 83 PID 1368 wrote to memory of 1456 1368 rundll32.exe 83 PID 1368 wrote to memory of 1456 1368 rundll32.exe 83 PID 1456 wrote to memory of 776 1456 e579933.exe 8 PID 1456 wrote to memory of 780 1456 e579933.exe 9 PID 1456 wrote to memory of 384 1456 e579933.exe 13 PID 1456 wrote to memory of 3008 1456 e579933.exe 50 PID 1456 wrote to memory of 64 1456 e579933.exe 51 PID 1456 wrote to memory of 3156 1456 e579933.exe 53 PID 1456 wrote to memory of 3452 1456 e579933.exe 56 PID 1456 wrote to memory of 3564 1456 e579933.exe 57 PID 1456 wrote to memory of 3772 1456 e579933.exe 58 PID 1456 wrote to memory of 3884 1456 e579933.exe 59 PID 1456 wrote to memory of 3944 1456 e579933.exe 60 PID 1456 wrote to memory of 4044 1456 e579933.exe 61 PID 1456 wrote to memory of 3696 1456 e579933.exe 62 PID 1456 wrote to memory of 5040 1456 e579933.exe 74 PID 1456 wrote to memory of 1208 1456 e579933.exe 76 PID 1456 wrote to memory of 1708 1456 e579933.exe 81 PID 1456 wrote to memory of 1368 1456 e579933.exe 82 PID 1456 wrote to memory of 1368 1456 e579933.exe 82 PID 1368 wrote to memory of 3520 1368 rundll32.exe 84 PID 1368 wrote to memory of 3520 1368 rundll32.exe 84 PID 1368 wrote to memory of 3520 1368 rundll32.exe 84 PID 1368 wrote to memory of 5112 1368 rundll32.exe 85 PID 1368 wrote to memory of 5112 1368 rundll32.exe 85 PID 1368 wrote to memory of 5112 1368 rundll32.exe 85 PID 1368 wrote to memory of 4880 1368 rundll32.exe 86 PID 1368 wrote to memory of 4880 1368 rundll32.exe 86 PID 1368 wrote to memory of 4880 1368 rundll32.exe 86 PID 1456 wrote to memory of 776 1456 e579933.exe 8 PID 1456 wrote to memory of 780 1456 e579933.exe 9 PID 1456 wrote to memory of 384 1456 e579933.exe 13 PID 1456 wrote to memory of 3008 1456 e579933.exe 50 PID 1456 wrote to memory of 64 1456 e579933.exe 51 PID 1456 wrote to memory of 3156 1456 e579933.exe 53 PID 1456 wrote to memory of 3452 1456 e579933.exe 56 PID 1456 wrote to memory of 3564 1456 e579933.exe 57 PID 1456 wrote to memory of 3772 1456 e579933.exe 58 PID 1456 wrote to memory of 3884 1456 e579933.exe 59 PID 1456 wrote to memory of 3944 1456 e579933.exe 60 PID 1456 wrote to memory of 4044 1456 e579933.exe 61 PID 1456 wrote to memory of 3696 1456 e579933.exe 62 PID 1456 wrote to memory of 5040 1456 e579933.exe 74 PID 1456 wrote to memory of 1208 1456 e579933.exe 76 PID 1456 wrote to memory of 3520 1456 e579933.exe 84 PID 1456 wrote to memory of 3520 1456 e579933.exe 84 PID 1456 wrote to memory of 5112 1456 e579933.exe 85 PID 1456 wrote to memory of 5112 1456 e579933.exe 85 PID 1456 wrote to memory of 4880 1456 e579933.exe 86 PID 1456 wrote to memory of 4880 1456 e579933.exe 86 PID 4880 wrote to memory of 776 4880 e57b4c9.exe 8 PID 4880 wrote to memory of 780 4880 e57b4c9.exe 9 PID 4880 wrote to memory of 384 4880 e57b4c9.exe 13 PID 4880 wrote to memory of 3008 4880 e57b4c9.exe 50 PID 4880 wrote to memory of 64 4880 e57b4c9.exe 51 PID 4880 wrote to memory of 3156 4880 e57b4c9.exe 53 PID 4880 wrote to memory of 3452 4880 e57b4c9.exe 56 PID 4880 wrote to memory of 3564 4880 e57b4c9.exe 57 PID 4880 wrote to memory of 3772 4880 e57b4c9.exe 58 PID 4880 wrote to memory of 3884 4880 e57b4c9.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b4c9.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:64
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\e579933.exeC:\Users\Admin\AppData\Local\Temp\e579933.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\e579a3c.exeC:\Users\Admin\AppData\Local\Temp\e579a3c.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520
-
-
C:\Users\Admin\AppData\Local\Temp\e57b4b9.exeC:\Users\Admin\AppData\Local\Temp\e57b4b9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\e57b4c9.exeC:\Users\Admin\AppData\Local\Temp\e57b4c9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4880
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3564
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3772
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3944
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3696
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:5040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1208
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5d310d670117b51dd88fa957438faba77
SHA132e3f2b78eb31e7b1c0bed1ae6e3392fa00213fa
SHA2562a5d2886ec8dcacce20372d11104681967f073f5caba68f940e6a538c9fb5adb
SHA51251e4b55e57fc3e420489273f9414deeeeb23159978b1348fa18a39cb13ca401e5b60445d9c7551158af6c70ba8502d2ebc7b828697058a91028fb85a50ae427d
-
Filesize
257B
MD5392527e9ad8f13041e884ab188f29059
SHA128be9b8d4946bc70ae77f8e851bdf223c0715693
SHA256f58cbb90045e22d241ab81c6dc445cca296efb35f8ed42a85bd1092265dbdd35
SHA512ef0035b87d0bd164d3e6f1b30f2e6529e8c46b57ccdda25a4eeb1e8c7de44a54de2b535909f4557b43e8a77eb3808f5943299fd5cf04f4c48e3222b05f7b9ec2