Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-12-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll
-
Size
120KB
-
MD5
24d585773a8555605d1481ece19761c0
-
SHA1
29f5b8ea6bb52f031211e7a11e9a5e524e074927
-
SHA256
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122
-
SHA512
75eb95d8164142519c3f98813c822f4778e7f98681656336ae2fccaa8bba5f1896084b3ec11e38fb7e084c182d029a3787d8a5f62c8548787759b9346a334760
-
SSDEEP
3072:UZWZ0zaRvsmGFSi42JcYNOPv7it2Mh+UWj1AVvlv0D3:UZWwYvsmO9X7Oritlh+UWIdc
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b4fd.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b4fd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76891d.exe -
Executes dropped EXE 3 IoCs
pid Process 2020 f76891d.exe 2944 f768aa3.exe 752 f76b4fd.exe -
Loads dropped DLL 6 IoCs
pid Process 2532 rundll32.exe 2532 rundll32.exe 2532 rundll32.exe 2532 rundll32.exe 2532 rundll32.exe 2532 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76891d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b4fd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76891d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768aa3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b4fd.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: f76891d.exe File opened (read-only) \??\L: f76891d.exe File opened (read-only) \??\J: f76b4fd.exe File opened (read-only) \??\N: f76891d.exe File opened (read-only) \??\I: f76b4fd.exe File opened (read-only) \??\H: f76b4fd.exe File opened (read-only) \??\E: f76891d.exe File opened (read-only) \??\G: f76891d.exe File opened (read-only) \??\H: f76891d.exe File opened (read-only) \??\I: f76891d.exe File opened (read-only) \??\M: f76891d.exe File opened (read-only) \??\K: f76891d.exe File opened (read-only) \??\O: f76891d.exe File opened (read-only) \??\E: f76b4fd.exe File opened (read-only) \??\G: f76b4fd.exe -
resource yara_rule behavioral1/memory/2020-23-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-15-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-12-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-19-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-22-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-20-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-16-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-14-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-21-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-17-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-64-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-65-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-66-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-67-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-69-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-70-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-73-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-88-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-103-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-105-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-107-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-109-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-110-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2020-147-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2944-175-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2944-193-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f76896b f76891d.exe File opened for modification C:\Windows\SYSTEM.INI f76891d.exe File created C:\Windows\f76da0a f768aa3.exe File created C:\Windows\f76dc99 f76b4fd.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76891d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f768aa3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b4fd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2020 f76891d.exe 2020 f76891d.exe 2944 f768aa3.exe 752 f76b4fd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2020 f76891d.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 2944 f768aa3.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe Token: SeDebugPrivilege 752 f76b4fd.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2532 2524 rundll32.exe 30 PID 2524 wrote to memory of 2532 2524 rundll32.exe 30 PID 2524 wrote to memory of 2532 2524 rundll32.exe 30 PID 2524 wrote to memory of 2532 2524 rundll32.exe 30 PID 2524 wrote to memory of 2532 2524 rundll32.exe 30 PID 2524 wrote to memory of 2532 2524 rundll32.exe 30 PID 2524 wrote to memory of 2532 2524 rundll32.exe 30 PID 2532 wrote to memory of 2020 2532 rundll32.exe 31 PID 2532 wrote to memory of 2020 2532 rundll32.exe 31 PID 2532 wrote to memory of 2020 2532 rundll32.exe 31 PID 2532 wrote to memory of 2020 2532 rundll32.exe 31 PID 2020 wrote to memory of 1040 2020 f76891d.exe 17 PID 2020 wrote to memory of 1104 2020 f76891d.exe 19 PID 2020 wrote to memory of 1184 2020 f76891d.exe 21 PID 2020 wrote to memory of 808 2020 f76891d.exe 25 PID 2020 wrote to memory of 2524 2020 f76891d.exe 29 PID 2020 wrote to memory of 2532 2020 f76891d.exe 30 PID 2020 wrote to memory of 2532 2020 f76891d.exe 30 PID 2532 wrote to memory of 2944 2532 rundll32.exe 32 PID 2532 wrote to memory of 2944 2532 rundll32.exe 32 PID 2532 wrote to memory of 2944 2532 rundll32.exe 32 PID 2532 wrote to memory of 2944 2532 rundll32.exe 32 PID 2020 wrote to memory of 1040 2020 f76891d.exe 17 PID 2020 wrote to memory of 1104 2020 f76891d.exe 19 PID 2020 wrote to memory of 1184 2020 f76891d.exe 21 PID 2020 wrote to memory of 808 2020 f76891d.exe 25 PID 2020 wrote to memory of 2524 2020 f76891d.exe 29 PID 2020 wrote to memory of 2944 2020 f76891d.exe 32 PID 2020 wrote to memory of 2944 2020 f76891d.exe 32 PID 2532 wrote to memory of 752 2532 rundll32.exe 33 PID 2532 wrote to memory of 752 2532 rundll32.exe 33 PID 2532 wrote to memory of 752 2532 rundll32.exe 33 PID 2532 wrote to memory of 752 2532 rundll32.exe 33 PID 2944 wrote to memory of 1040 2944 f768aa3.exe 17 PID 2944 wrote to memory of 1104 2944 f768aa3.exe 19 PID 2944 wrote to memory of 1184 2944 f768aa3.exe 21 PID 2944 wrote to memory of 808 2944 f768aa3.exe 25 PID 2944 wrote to memory of 752 2944 f768aa3.exe 33 PID 2944 wrote to memory of 752 2944 f768aa3.exe 33 PID 752 wrote to memory of 1040 752 f76b4fd.exe 17 PID 752 wrote to memory of 1104 752 f76b4fd.exe 19 PID 752 wrote to memory of 1184 752 f76b4fd.exe 21 PID 752 wrote to memory of 808 752 f76b4fd.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b4fd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76891d.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1040
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1104
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\f76891d.exeC:\Users\Admin\AppData\Local\Temp\f76891d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\f768aa3.exeC:\Users\Admin\AppData\Local\Temp\f768aa3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\f76b4fd.exeC:\Users\Admin\AppData\Local\Temp\f76b4fd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:752
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:808
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5cd189231ba444c373ee1bb19ce4cfbcb
SHA1c40f21eb92e7fb7821f2ca3cd078a9c93f383d1f
SHA256a27256808961a1bca8d7ff46b7c84e2171d513045621baea14ac398f47410377
SHA512f71958636784d1f1e38e6be39ea2d15429781091c2f94d0b236530faf1caa0c3016aa578e0c376008cd6bfa8e304ab576149fbc21c7ea5b15fd513b998f38bb9
-
Filesize
97KB
MD5bbc10c7ba3dfea281f7d7bfe26d31439
SHA17b0ef0df1129ac9c9073aeabd92ee94c68f68079
SHA256cbe2f240b04c1c71cea52c463d610f885a34f907ea1080a0447cf32e4d198396
SHA512489c0439f3e6fbb49da1297b49f1961a7c5b4d469be2b891a10c225f8817b305f0d816b126692acc02227ad4d6446619f6718b0a11d7589972204d5f17eaa246