sality | 8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187

Analysis

max time kernel
0s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 01:47

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Size

945KB
MD5

30846472b2e0b131869e066de6d065ee
SHA1

2c6473d66326fdb0b70d305229410d731a4dc57b
SHA256

8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187
SHA512

6621483ea840bce01867e8932594ff4890844639a6f7c1c258e95274298b90faa0f1b156978405d08567bd23c5cbc121c6e8e9a6bc8e20f2e56683478064cc4f
SSDEEP

24576:UvoTKUsEyEyK+LS3g9KXqKtu73aB0vlnD:UvouUPk9evtu7KqdD

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2688	attrib.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2104	icacls.exe
1916	icacls.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/844-1-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-3-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-8-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-18-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-16-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-20-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-9-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-5-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-17-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-4-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-21-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-24-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-23-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-25-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-27-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-26-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-29-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-30-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-50-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-66-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-67-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-72-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-74-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-77-0x0000000002570000-0x000000000362A000-memory.dmp	upx
behavioral2/memory/844-99-0x0000000002570000-0x000000000362A000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\e57b391	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
File opened for modification	C:\Windows\SYSTEM.INI	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
Token: SeDebugPrivilege	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 764	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe	8
PID 844 wrote to memory of 768	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe	9
PID 844 wrote to memory of 384	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe	13
PID 844 wrote to memory of 2572	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe	44
PID 844 wrote to memory of 2588	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe	45
PID 844 wrote to memory of 2736	844	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe	47

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2688	attrib.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:764

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:384

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2588

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2736

C:\Users\Admin\AppData\Local\Temp\8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe
"C:\Users\Admin\AppData\Local\Temp\8fe62b5aa221fb6dc9c75ce17226f8397e9e6834dfe188c353f2c3eb01f16187.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\run.exe /inst sys >C:\Users\Admin\AppData\Local\Temp\tmp.dll
  2⤵
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\run.exe
    C:\Users\Admin\AppData\Local\Temp\run.exe /inst sys
    3⤵
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\run.exe /rest sys >C:\Users\Admin\AppData\Local\Temp\tmp.dll
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\boot.exe
  "C:\Users\Admin\AppData\Local\Temp\boot.exe" /nt60 sys
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\run.exe /inst sys >C:\Users\Admin\AppData\Local\Temp\tmp.dll
  2⤵
  PID:64
- - C:\Users\Admin\AppData\Local\Temp\run.exe
    C:\Users\Admin\AppData\Local\Temp\run.exe /inst sys
    3⤵
    PID:2860
- C:\Windows\SysWOW64\compact.exe
  "C:\Windows\System32\compact.exe" /u /a /i E:\XQVPW
  2⤵
  PID:4556
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" E:\XQVPW +h +s +r
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2688
- C:\Windows\SysWOW64\icacls.exe
  "C:\Windows\System32\icacls.exe" E:\XQVPW /remove administrators
  2⤵
  - Modifies file permissions
  PID:2104
- C:\Windows\SysWOW64\icacls.exe
  "C:\Windows\System32\icacls.exe" E:\XQVPW /inheritance:r
  2⤵
  - Modifies file permissions
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo %windir%\system32\slmgr.vbs -ilc C:\Users\Admin\AppData\Local\Temp\license.xrm-ms >C:\Users\Admin\AppData\Local\Temp\tmp3.dll
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo C:\Windows\system32\slmgr.vbs -ilc C:\Users\Admin\AppData\Local\Temp\license.xrm-ms
    3⤵
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo %windir%\system32\slmgr.vbs >C:\Users\Admin\AppData\Local\Temp\tmp2.dll
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo C:\Windows\system32\slmgr.vbs
    3⤵
    PID:4224

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ae055 /state1:0x41c64e6d
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\boot.exe

Filesize
32KB

MD5
1386b69045a421d6314b6f25d5784090

SHA1
5c733c304db905e58a7f21eedb2604a1a2cc6cdf

SHA256
8a29adcab8ed51d3d9a31c7aa932ecca1937561b827cb800e8e2f5f0f9dac97b

SHA512
67c579ab3fbeb73175d7582f48add0739ac87ed36d94c30c3fac9df1836e7bddf4e75e5a81870f277c31a386c50be2bca0e784c1964969f8ddcb6b4e2b14f14a

Download Submit
C:\Users\Admin\AppData\Local\Temp\license.xrm-ms

Filesize
2KB

MD5
ca2e3db831243a8bf1f09a5fcc7966a6

SHA1
0ae292cdb3578f3e86f4a4f529d500a9ebb458ba

SHA256
9bd3bba860030740ddafc5b38321eb3711c607e6b31b951a3fa9fe3bd6e8d379

SHA512
57e9a05ce111647330af177fe70badda9d2297c54ccc7a6c9fd10d52f3e2411478519f489dd1276871993fe59db2c4cedf1eee2a57140d76d53e518c5f154768

Download Submit
C:\Users\Admin\AppData\Local\Temp\run.exe

Filesize
95KB

MD5
334c861511baee5bf4ce2dc9cd012506

SHA1
180e6f0cb6647af21c8001fc698584349cb62c78

SHA256
36ffb002e96769beccbcb20dced2d05c44e6a320075e8450607fe782522080df

SHA512
a9195cb5571d16169471b92e4e609a8a6e5dacd1d041488bd6e39d8be4d8a278a09016da29afca5ebf622fdc913548261bc87ac60ca0794d78dfb584958a11a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.dll

Filesize
346B

MD5
37bc6d406aa853e0b7f33d8372bf9335

SHA1
31122b18a6e005cec05c4ed2f34edb4ea9a8cb72

SHA256
3f153db7fc855f691d3adc12e86c6416b26aa5f21cf1c4b7903c607c5bd1b5cb

SHA512
b02fe614a97cf227d53225b2cd361d1b2589342109f2cd18913654537e190651bad46113817e5ec2d3afbeb38db3a4d6ef8722b19a7b79a2122229e23fd9b43b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.dll

Filesize
351B

MD5
43a54dafe6cbe02ba27ebcc98bd15f2c

SHA1
9a14e65bd9c14c4a9ed7eaddf798cbcb16878ba4

SHA256
f63d7cb8af2560f5da50d504dbacf0d1584ed68c8454a292c403d3a8908b9919

SHA512
c99ecdc0c5a01043dfe7e67898f60af86d7f9d5362f350e12b91d8946cc909ce9d251fcf4dbf37f28fb24588439384b0ffd738385b78cd47cc0db1f034c0b8f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.dll

Filesize
4KB

MD5
af8fcf7ad89e28ba0d3d721889070eff

SHA1
40109257c24e033610241320d072fee2688fb4b4

SHA256
2687963769728529426d40bdb9346ec01bdffbbb7284ebbc347245334759c86b

SHA512
94ed2f28d9381a8492224a2fb44f1cdfc38189e77f37dfd821ff53caa941a864a29b9d70a7b071a614be76a9002be81ce9bda0196eb5ad787b5c2e97b7f924ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3.dll

Filesize
91B

MD5
a014f9d517d80bff6f001ce99e60ab3d

SHA1
3255153ef0e9256c6063bf24f23af09de707e35f

SHA256
76eb6e3f41ef3a435fce3cc8096d4281a7c8c73a332ac34c82d6f214c777b2ff

SHA512
d435c6384f12c1e4f283d488d0dd95e4ac27bff28af898b124b67c21ca8bc0cefc26612a089262b17c985cc7a40e69ee61d6abef7aaee94fbda3ffe1c39dc445

Download Submit
\??\E:\XQVPW

Filesize
326KB

MD5
d484d787580891c3a6502ef4da290ed0

SHA1
a3fbef0e8322bd03357dbc1aa6c13f3fcd53ad8d

SHA256
01ae2d77e738197028b87dfc767473e043e18c7beefd0ca6b9123dd64997ebc8

SHA512
5c446456f1fe7c26c407102c39f664c03da4fac001c7cc04205e6fc918ea7b2d9ede76f1cc0ad1e33115155803a19b569ece1024c042956ddba5998414b03252

Download Submit
memory/844-17-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-51-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/844-5-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-0-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/844-4-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-10-0x0000000003B80000-0x0000000003B82000-memory.dmp

Filesize
8KB

Download
memory/844-7-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/844-6-0x0000000003B80000-0x0000000003B82000-memory.dmp

Filesize
8KB

Download
memory/844-21-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-24-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-23-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-25-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-27-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-26-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-29-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-30-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-9-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-20-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-16-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-19-0x0000000003B80000-0x0000000003B82000-memory.dmp

Filesize
8KB

Download
memory/844-22-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/844-50-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-18-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-8-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-3-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-1-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-66-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-68-0x0000000003B80000-0x0000000003B82000-memory.dmp

Filesize
8KB

Download
memory/844-67-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-71-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/844-70-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/844-72-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-74-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-77-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download
memory/844-98-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/844-89-0x0000000003B80000-0x0000000003B82000-memory.dmp

Filesize
8KB

Download
memory/844-99-0x0000000002570000-0x000000000362A000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads