Analysis
-
max time kernel
92s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2024 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b87367c0e549eb29516edb1d45ab2eaa9060036ae2376a2c8b7e33fc38b3b93.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
8b87367c0e549eb29516edb1d45ab2eaa9060036ae2376a2c8b7e33fc38b3b93.dll
-
Size
120KB
-
MD5
ee1f286e46586a772ca9681eed89c081
-
SHA1
76f296b46d24a3156b7e18a4d5b1af2d465a7730
-
SHA256
8b87367c0e549eb29516edb1d45ab2eaa9060036ae2376a2c8b7e33fc38b3b93
-
SHA512
41ac747e54dcf64cc71d21a9991a7c4aaddd23457456b94ab30831f59833d2047fab1aa500b8e89cbfd440ff9cacfdeda7307ee41e1116badb42321bbf121886
-
SSDEEP
3072:VmoVwkRKC2sU+1VC1IEoiKtmYvvOIP5q7Rtm0/iE:0oVfdPtiSY0PSmi
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57d205.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57d205.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57d205.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d205.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57d205.exe -
Executes dropped EXE 4 IoCs
pid Process 2816 e57b66f.exe 3836 e57b882.exe 2312 e57d1f6.exe 244 e57d205.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b66f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57d205.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57d205.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57d205.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d205.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: e57b66f.exe File opened (read-only) \??\J: e57b66f.exe File opened (read-only) \??\L: e57b66f.exe File opened (read-only) \??\P: e57b66f.exe File opened (read-only) \??\Q: e57b66f.exe File opened (read-only) \??\G: e57b66f.exe File opened (read-only) \??\K: e57b66f.exe File opened (read-only) \??\M: e57b66f.exe File opened (read-only) \??\N: e57b66f.exe File opened (read-only) \??\E: e57d205.exe File opened (read-only) \??\S: e57b66f.exe File opened (read-only) \??\T: e57b66f.exe File opened (read-only) \??\E: e57b66f.exe File opened (read-only) \??\H: e57b66f.exe File opened (read-only) \??\I: e57b66f.exe File opened (read-only) \??\O: e57b66f.exe -
resource yara_rule behavioral2/memory/2816-10-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-9-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-8-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-12-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-18-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-22-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-20-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-19-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-21-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-11-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-35-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-36-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-37-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-38-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-39-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-41-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-42-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-56-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-58-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-60-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-62-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-75-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-79-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-78-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-82-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-83-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-86-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-88-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-90-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-95-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/2816-98-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/244-127-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/244-165-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57b66f.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57b66f.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57b66f.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57b66f.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57b6dc e57b66f.exe File opened for modification C:\Windows\SYSTEM.INI e57b66f.exe File created C:\Windows\e5807cb e57d205.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b66f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57d1f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57d205.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2816 e57b66f.exe 2816 e57b66f.exe 2816 e57b66f.exe 2816 e57b66f.exe 244 e57d205.exe 244 e57d205.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe Token: SeDebugPrivilege 2816 e57b66f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4188 wrote to memory of 2024 4188 rundll32.exe 85 PID 4188 wrote to memory of 2024 4188 rundll32.exe 85 PID 4188 wrote to memory of 2024 4188 rundll32.exe 85 PID 2024 wrote to memory of 2816 2024 rundll32.exe 86 PID 2024 wrote to memory of 2816 2024 rundll32.exe 86 PID 2024 wrote to memory of 2816 2024 rundll32.exe 86 PID 2816 wrote to memory of 804 2816 e57b66f.exe 9 PID 2816 wrote to memory of 812 2816 e57b66f.exe 10 PID 2816 wrote to memory of 376 2816 e57b66f.exe 13 PID 2816 wrote to memory of 2672 2816 e57b66f.exe 45 PID 2816 wrote to memory of 2688 2816 e57b66f.exe 46 PID 2816 wrote to memory of 3044 2816 e57b66f.exe 52 PID 2816 wrote to memory of 3404 2816 e57b66f.exe 56 PID 2816 wrote to memory of 3528 2816 e57b66f.exe 57 PID 2816 wrote to memory of 3724 2816 e57b66f.exe 58 PID 2816 wrote to memory of 3812 2816 e57b66f.exe 59 PID 2816 wrote to memory of 3884 2816 e57b66f.exe 60 PID 2816 wrote to memory of 3976 2816 e57b66f.exe 61 PID 2816 wrote to memory of 3756 2816 e57b66f.exe 62 PID 2816 wrote to memory of 436 2816 e57b66f.exe 64 PID 2816 wrote to memory of 2444 2816 e57b66f.exe 76 PID 2816 wrote to memory of 428 2816 e57b66f.exe 77 PID 2816 wrote to memory of 2304 2816 e57b66f.exe 78 PID 2816 wrote to memory of 2316 2816 e57b66f.exe 83 PID 2816 wrote to memory of 4188 2816 e57b66f.exe 84 PID 2816 wrote to memory of 2024 2816 e57b66f.exe 85 PID 2816 wrote to memory of 2024 2816 e57b66f.exe 85 PID 2024 wrote to memory of 3836 2024 rundll32.exe 87 PID 2024 wrote to memory of 3836 2024 rundll32.exe 87 PID 2024 wrote to memory of 3836 2024 rundll32.exe 87 PID 2024 wrote to memory of 2312 2024 rundll32.exe 89 PID 2024 wrote to memory of 2312 2024 rundll32.exe 89 PID 2024 wrote to memory of 2312 2024 rundll32.exe 89 PID 2024 wrote to memory of 244 2024 rundll32.exe 90 PID 2024 wrote to memory of 244 2024 rundll32.exe 90 PID 2024 wrote to memory of 244 2024 rundll32.exe 90 PID 2816 wrote to memory of 804 2816 e57b66f.exe 9 PID 2816 wrote to memory of 812 2816 e57b66f.exe 10 PID 2816 wrote to memory of 376 2816 e57b66f.exe 13 PID 2816 wrote to memory of 2672 2816 e57b66f.exe 45 PID 2816 wrote to memory of 2688 2816 e57b66f.exe 46 PID 2816 wrote to memory of 3044 2816 e57b66f.exe 52 PID 2816 wrote to memory of 3404 2816 e57b66f.exe 56 PID 2816 wrote to memory of 3528 2816 e57b66f.exe 57 PID 2816 wrote to memory of 3724 2816 e57b66f.exe 58 PID 2816 wrote to memory of 3812 2816 e57b66f.exe 59 PID 2816 wrote to memory of 3884 2816 e57b66f.exe 60 PID 2816 wrote to memory of 3976 2816 e57b66f.exe 61 PID 2816 wrote to memory of 3756 2816 e57b66f.exe 62 PID 2816 wrote to memory of 436 2816 e57b66f.exe 64 PID 2816 wrote to memory of 2444 2816 e57b66f.exe 76 PID 2816 wrote to memory of 3836 2816 e57b66f.exe 87 PID 2816 wrote to memory of 3836 2816 e57b66f.exe 87 PID 2816 wrote to memory of 2312 2816 e57b66f.exe 89 PID 2816 wrote to memory of 2312 2816 e57b66f.exe 89 PID 2816 wrote to memory of 244 2816 e57b66f.exe 90 PID 2816 wrote to memory of 244 2816 e57b66f.exe 90 PID 244 wrote to memory of 804 244 e57d205.exe 9 PID 244 wrote to memory of 812 244 e57d205.exe 10 PID 244 wrote to memory of 376 244 e57d205.exe 13 PID 244 wrote to memory of 2672 244 e57d205.exe 45 PID 244 wrote to memory of 2688 244 e57d205.exe 46 PID 244 wrote to memory of 3044 244 e57d205.exe 52 PID 244 wrote to memory of 3404 244 e57d205.exe 56 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b66f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57d205.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2688
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3044
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3404
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b87367c0e549eb29516edb1d45ab2eaa9060036ae2376a2c8b7e33fc38b3b93.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b87367c0e549eb29516edb1d45ab2eaa9060036ae2376a2c8b7e33fc38b3b93.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\e57b66f.exeC:\Users\Admin\AppData\Local\Temp\e57b66f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\e57b882.exeC:\Users\Admin\AppData\Local\Temp\e57b882.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3836
-
-
C:\Users\Admin\AppData\Local\Temp\e57d1f6.exeC:\Users\Admin\AppData\Local\Temp\e57d1f6.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\e57d205.exeC:\Users\Admin\AppData\Local\Temp\e57d205.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:244
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3528
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3724
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3812
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3884
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3976
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3756
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:436
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2444
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:428
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2304
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2316
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5dc72300b186fe6fc8cfb78c1398af1c2
SHA1184ea85fafb5fc5bef4741fbbae9d811404c6a1c
SHA256f37279e4945489b1b08841db12ec0bd04e75eae5562c5602a7950646a96edaee
SHA5129bdd79a521f69a49e67688143e751db5e2a9c5b65fe8fbaabf4ee8cefbdb6e4e1e584d89d17a2cc1931aac7c30dd78b82a97044cf287c22c26d10bdcf42a6c01
-
Filesize
257B
MD5173e4bbdb5a5bbfc00ae377d3477a147
SHA1e5f097d7bccb30a8bebebebc372e8d6160b4a05e
SHA2565f305fd9ee3ef2cd163e6caf56af5face54376f00c142d87458ea6308c81ba8d
SHA512e81ef6f8156e35e49427ce8963ec6216ec3c4375a94a09767a8276e2251dea6c516db7c8f261bce9852b3b0c0acfc608db546e66ff83ee0236c62eb9662b9541