Analysis
-
max time kernel
94s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll
-
Size
120KB
-
MD5
24d585773a8555605d1481ece19761c0
-
SHA1
29f5b8ea6bb52f031211e7a11e9a5e524e074927
-
SHA256
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122
-
SHA512
75eb95d8164142519c3f98813c822f4778e7f98681656336ae2fccaa8bba5f1896084b3ec11e38fb7e084c182d029a3787d8a5f62c8548787759b9346a334760
-
SSDEEP
3072:UZWZ0zaRvsmGFSi42JcYNOPv7it2Mh+UWj1AVvlv0D3:UZWwYvsmO9X7Oritlh+UWIdc
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578453.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578453.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57690a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57690a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57690a.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578453.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578453.exe -
Executes dropped EXE 4 IoCs
pid Process 2176 e57690a.exe 3924 e576ac0.exe 4224 e578453.exe 4480 e578482.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578453.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57690a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578453.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578453.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: e57690a.exe File opened (read-only) \??\N: e57690a.exe File opened (read-only) \??\Q: e57690a.exe File opened (read-only) \??\E: e578453.exe File opened (read-only) \??\P: e57690a.exe File opened (read-only) \??\S: e57690a.exe File opened (read-only) \??\E: e57690a.exe File opened (read-only) \??\G: e57690a.exe File opened (read-only) \??\H: e57690a.exe File opened (read-only) \??\J: e57690a.exe File opened (read-only) \??\M: e57690a.exe File opened (read-only) \??\I: e57690a.exe File opened (read-only) \??\K: e57690a.exe File opened (read-only) \??\O: e57690a.exe File opened (read-only) \??\R: e57690a.exe -
resource yara_rule behavioral2/memory/2176-9-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-14-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-12-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-20-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-21-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-13-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-11-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-10-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-8-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-32-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-36-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-37-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-38-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-39-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-40-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-42-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-43-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-55-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-61-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-62-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-76-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-78-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-81-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-83-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-85-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-86-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-89-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-90-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-92-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-101-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/2176-104-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/4224-137-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/4224-167-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57690a.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57690a.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57690a.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57690a.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e576968 e57690a.exe File opened for modification C:\Windows\SYSTEM.INI e57690a.exe File created C:\Windows\e57b9f9 e578453.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57690a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576ac0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578453.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2176 e57690a.exe 2176 e57690a.exe 2176 e57690a.exe 2176 e57690a.exe 4224 e578453.exe 4224 e578453.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe Token: SeDebugPrivilege 2176 e57690a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2148 2012 rundll32.exe 83 PID 2012 wrote to memory of 2148 2012 rundll32.exe 83 PID 2012 wrote to memory of 2148 2012 rundll32.exe 83 PID 2148 wrote to memory of 2176 2148 rundll32.exe 84 PID 2148 wrote to memory of 2176 2148 rundll32.exe 84 PID 2148 wrote to memory of 2176 2148 rundll32.exe 84 PID 2176 wrote to memory of 768 2176 e57690a.exe 8 PID 2176 wrote to memory of 784 2176 e57690a.exe 9 PID 2176 wrote to memory of 316 2176 e57690a.exe 13 PID 2176 wrote to memory of 2628 2176 e57690a.exe 44 PID 2176 wrote to memory of 2644 2176 e57690a.exe 45 PID 2176 wrote to memory of 2892 2176 e57690a.exe 51 PID 2176 wrote to memory of 3416 2176 e57690a.exe 56 PID 2176 wrote to memory of 3556 2176 e57690a.exe 57 PID 2176 wrote to memory of 3752 2176 e57690a.exe 58 PID 2176 wrote to memory of 3844 2176 e57690a.exe 59 PID 2176 wrote to memory of 3908 2176 e57690a.exe 60 PID 2176 wrote to memory of 3996 2176 e57690a.exe 61 PID 2176 wrote to memory of 3880 2176 e57690a.exe 62 PID 2176 wrote to memory of 4580 2176 e57690a.exe 74 PID 2176 wrote to memory of 2972 2176 e57690a.exe 76 PID 2176 wrote to memory of 2600 2176 e57690a.exe 81 PID 2176 wrote to memory of 2012 2176 e57690a.exe 82 PID 2176 wrote to memory of 2148 2176 e57690a.exe 83 PID 2176 wrote to memory of 2148 2176 e57690a.exe 83 PID 2148 wrote to memory of 3924 2148 rundll32.exe 85 PID 2148 wrote to memory of 3924 2148 rundll32.exe 85 PID 2148 wrote to memory of 3924 2148 rundll32.exe 85 PID 2148 wrote to memory of 4224 2148 rundll32.exe 87 PID 2148 wrote to memory of 4224 2148 rundll32.exe 87 PID 2148 wrote to memory of 4224 2148 rundll32.exe 87 PID 2148 wrote to memory of 4480 2148 rundll32.exe 88 PID 2148 wrote to memory of 4480 2148 rundll32.exe 88 PID 2148 wrote to memory of 4480 2148 rundll32.exe 88 PID 2176 wrote to memory of 768 2176 e57690a.exe 8 PID 2176 wrote to memory of 784 2176 e57690a.exe 9 PID 2176 wrote to memory of 316 2176 e57690a.exe 13 PID 2176 wrote to memory of 2628 2176 e57690a.exe 44 PID 2176 wrote to memory of 2644 2176 e57690a.exe 45 PID 2176 wrote to memory of 2892 2176 e57690a.exe 51 PID 2176 wrote to memory of 3416 2176 e57690a.exe 56 PID 2176 wrote to memory of 3556 2176 e57690a.exe 57 PID 2176 wrote to memory of 3752 2176 e57690a.exe 58 PID 2176 wrote to memory of 3844 2176 e57690a.exe 59 PID 2176 wrote to memory of 3908 2176 e57690a.exe 60 PID 2176 wrote to memory of 3996 2176 e57690a.exe 61 PID 2176 wrote to memory of 3880 2176 e57690a.exe 62 PID 2176 wrote to memory of 4580 2176 e57690a.exe 74 PID 2176 wrote to memory of 2972 2176 e57690a.exe 76 PID 2176 wrote to memory of 3924 2176 e57690a.exe 85 PID 2176 wrote to memory of 3924 2176 e57690a.exe 85 PID 2176 wrote to memory of 4224 2176 e57690a.exe 87 PID 2176 wrote to memory of 4224 2176 e57690a.exe 87 PID 2176 wrote to memory of 4480 2176 e57690a.exe 88 PID 2176 wrote to memory of 4480 2176 e57690a.exe 88 PID 4224 wrote to memory of 768 4224 e578453.exe 8 PID 4224 wrote to memory of 784 4224 e578453.exe 9 PID 4224 wrote to memory of 316 4224 e578453.exe 13 PID 4224 wrote to memory of 2628 4224 e578453.exe 44 PID 4224 wrote to memory of 2644 4224 e578453.exe 45 PID 4224 wrote to memory of 2892 4224 e578453.exe 51 PID 4224 wrote to memory of 3416 4224 e578453.exe 56 PID 4224 wrote to memory of 3556 4224 e578453.exe 57 PID 4224 wrote to memory of 3752 4224 e578453.exe 58 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578453.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2644
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2892
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\e57690a.exeC:\Users\Admin\AppData\Local\Temp\e57690a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\e576ac0.exeC:\Users\Admin\AppData\Local\Temp\e576ac0.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\e578453.exeC:\Users\Admin\AppData\Local\Temp\e578453.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\e578482.exeC:\Users\Admin\AppData\Local\Temp\e578482.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3844
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3880
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4580
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2972
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5bbc10c7ba3dfea281f7d7bfe26d31439
SHA17b0ef0df1129ac9c9073aeabd92ee94c68f68079
SHA256cbe2f240b04c1c71cea52c463d610f885a34f907ea1080a0447cf32e4d198396
SHA512489c0439f3e6fbb49da1297b49f1961a7c5b4d469be2b891a10c225f8817b305f0d816b126692acc02227ad4d6446619f6718b0a11d7589972204d5f17eaa246
-
Filesize
257B
MD5d30060a4e24f2b6aa329e2dedd93b390
SHA1a872fb362c784a32f2042abc90228e267ee9e62f
SHA2560835c4af803dff8480fd89b643a925df712331cffd0d113882a7c3db991a6b41
SHA5128fbb445f1c0bb786a4c005588af8d318dccf69463f0cdebf3c4185292db53a134cd5f89e657f19ca2242ee88821fcc3482b543e10870da6214b43faffe765e81