Analysis
-
max time kernel
126s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 02:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
General
-
Target
b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe
-
Size
1.8MB
-
MD5
d5045053a5667f3fa4f4fe5b37afd5f2
-
SHA1
cfe262460d95f78e3c4beb6047f118fbf2f19a9f
-
SHA256
b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0
-
SHA512
c9d7dd9953d5df6fc2ec217e69b04377373cfd0a971fa02d6c10e6094dd6ed645b014ee366ea57316c909498fefccf8477400f66e96dce0cc0e99f9b43c28617
-
SSDEEP
24576:sIzkORYgO+fUP1NTnKgZOtEZcPwGXeFTaIqItxHH20XrP3I2IvrrP3bl8QBUm9w:DzntGrKwGXXetxHH2yr422rWh
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe File opened (read-only) \??\G: b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
resource yara_rule behavioral2/memory/1524-3-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-4-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-9-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-5-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-11-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-18-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-20-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-21-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-8-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-13-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-22-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-23-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-24-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-26-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-25-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-28-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-29-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx behavioral2/memory/1524-31-0x0000000000EC0000-0x0000000001F7A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e57afb8 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe File opened for modification C:\Windows\SYSTEM.INI b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807df252625adb01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4A4028E6-C655-11EF-ADF2-CAFD856C81B1} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "530531909" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152738" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152738" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "526156763" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442290483" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152738" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e39000000000200000000001066000000010000200000008ced8d4db1053f7c18472d7c6367605184c31c8d251a6fb4366e87df188abc0a000000000e8000000002000020000000be0131d3a16503a2d4453bf2abe59ef75c2ea30d5fe89961efad1d8fe074c232200000007bfc5c8a75207b9c60ce982b0a8114171b48e18c79c3c7651daae275461367ca400000004845883b4be07458a5e86c4fbeef6c7b6b6011944f70d574c823f53e9df688b5cecb9a7f762c4cbab730da9cf8dafcba6b382c9692adc809222f2a6aa5d2760f IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9051eb52625adb01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e3900000000020000000000106600000001000020000000d852eddfb3696e16cbce54a218836203e6b75935e64badbbcf5fbaf43b1d60cd000000000e80000000020000200000003b533e5ca9cf8764cb784ccbbbb00f2f8fa4a29660d1b28ca00bc487539a51f020000000706a909d4b6428bfdea92ed220f76f3db5f044a22977df2bc43824236788abea4000000001d85375d13092f10e1ed248ee3744d25ae3bd2fb11c07bde281ae162c4bdf4b2d620c899d8cb22b3df368c201f043ae80a6f62de81b41abc3577e65a018c597 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152738" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "526156763" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "530531909" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2576 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 3444 IEXPLORE.EXE 3444 IEXPLORE.EXE 3444 IEXPLORE.EXE 3444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1524 wrote to memory of 800 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 8 PID 1524 wrote to memory of 808 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 9 PID 1524 wrote to memory of 388 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 13 PID 1524 wrote to memory of 2676 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 45 PID 1524 wrote to memory of 2760 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 48 PID 1524 wrote to memory of 2352 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 52 PID 1524 wrote to memory of 3436 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 56 PID 1524 wrote to memory of 3556 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 57 PID 1524 wrote to memory of 3748 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 58 PID 1524 wrote to memory of 3840 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 59 PID 1524 wrote to memory of 3900 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 60 PID 1524 wrote to memory of 3996 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 61 PID 1524 wrote to memory of 3684 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 62 PID 1524 wrote to memory of 4576 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 74 PID 1524 wrote to memory of 4660 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 76 PID 1524 wrote to memory of 4124 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 84 PID 1524 wrote to memory of 4124 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 84 PID 1524 wrote to memory of 4124 1524 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 84 PID 4124 wrote to memory of 2576 4124 iexplore.exe 85 PID 4124 wrote to memory of 2576 4124 iexplore.exe 85 PID 2576 wrote to memory of 3444 2576 IEXPLORE.EXE 86 PID 2576 wrote to memory of 3444 2576 IEXPLORE.EXE 86 PID 2576 wrote to memory of 3444 2576 IEXPLORE.EXE 86 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2760
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2352
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe"C:\Users\Admin\AppData\Local\Temp\b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1524 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3444
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3684
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4576
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4660
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5203ddc09084e958498293f6ecef1a1e4
SHA1df8fdc39325e88a761ef4da69509b1bd8d3ef2a6
SHA256bcb41b57c4ce82debc1f42013cd577ba427df23c39b3e356678cb0cb1268020c
SHA512812d76aaf43f4884c59de4d0b6f5c9ec7493dbaf621c384a046e78f3ac3c3304943127c95a0d083f752557f9636c18f743b7be8c2e0447f7d43076ad14b62fb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5201c4b5709769e3fe1502a50b0032dde
SHA16d1366bd24403c334dad78b4596d076647f6d4fa
SHA25647bcbbaf7152b31394238800f1e89b8fd4c91dd448cae8836bf540022252c331
SHA512b0fecceedc3534099eb6a2a294875e889f79488ddf40ec47d27e7f5d55dec43735254c3b3a054f637093ca1b3a0296f3abaa8705112d04ba2398ca5e2e3029a8
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
1KB
MD52416fced702202479f1a6b8d5a41c344
SHA128952176d1589d1fe716beee8119da1f2b1564e9
SHA256e4331d7911ee64a4446bad659b06fd37eff1381506fcad99b06169455ac78e31
SHA5124fef2a5e499cb069f4579bb462357cd2dd201e4719242d5b7a59d9078c879965e845e98919fe80acc58e8d9740fc2998a25abe5fa85bb61835e3babf3a688c26
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
1KB
MD59666d7d69681361c8f1ee6e1352b37a1
SHA1026d01b3e9a1c8752be75f348484713f64099551
SHA2562a40e46debd9a2139f8d6bfd02b2fb15039373d67965a352c9a2c9cbe45257b0
SHA512ca6ce9f0c7cec6a409d0a5ac05df757e90fd8812c6df12fbb09144d00bca10ab3a091120f0b10de584d966e5eafba14ca8823103c594b868dce0858c9ab6d9f8