Analysis
-
max time kernel
102s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
General
-
Target
b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe
-
Size
1.8MB
-
MD5
d5045053a5667f3fa4f4fe5b37afd5f2
-
SHA1
cfe262460d95f78e3c4beb6047f118fbf2f19a9f
-
SHA256
b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0
-
SHA512
c9d7dd9953d5df6fc2ec217e69b04377373cfd0a971fa02d6c10e6094dd6ed645b014ee366ea57316c909498fefccf8477400f66e96dce0cc0e99f9b43c28617
-
SSDEEP
24576:sIzkORYgO+fUP1NTnKgZOtEZcPwGXeFTaIqItxHH20XrP3I2IvrrP3bl8QBUm9w:DzntGrKwGXXetxHH2yr422rWh
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe File opened (read-only) \??\G: b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
resource yara_rule behavioral2/memory/4988-3-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-16-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-15-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-19-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-14-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-17-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-5-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-6-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-4-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-20-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-23-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-22-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-24-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-25-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-26-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-28-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-29-0x0000000000FD0000-0x000000000208A000-memory.dmp upx behavioral2/memory/4988-31-0x0000000000FD0000-0x000000000208A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e57b3cf b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe File opened for modification C:\Windows\SYSTEM.INI b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152739" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152739" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152739" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "42589003" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e6b828635adb01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "41963977" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e390000000002000000000010660000000100002000000034da8b1085c8ca2270e8919f6ac0dcd404e355536f50648408979bec5e41ac02000000000e80000000020000200000000a8aac4c0e1cbadd3988dc293922f137fb7c91627c0133834ab529694fa0a8b720000000665fed51e35e237481c175bc822a8aeb171cf89bb87c7beb0196d5c608199e91400000004c289493fe43f975e2a51f43cdec7665c2f2d859842672581dc1c7f6ce17721499bef5eb542992d98996ac67884ef2d9c716a7c1f9d1cc6a8fc58aedbb42f691 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7057bb28635adb01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "42589003" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152739" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2DE71827-C656-11EF-ADF2-FE5A08828E79} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442290866" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "41963977" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e39000000000200000000001066000000010000200000003a74844e1ade4ab16dafeec779c7b6ac9714280d9eaf29ad8cddfd517e01d15b000000000e800000000200002000000082f3663cf64f92ea12056bb2950caf97b4f3f7c15303780e61858238d6f016a0200000001d08eb19ce5fa14d3b463a728195d925df581ae7198218d9fde812763f7161c940000000f2b58350cea138b63b170481febc8b34f12b503b82e34351260c989b0bc203183ec06f1212c7880fc9168b2f119406dd749ceeb4c3483ba5518c63b5fef713e5 IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe Token: SeDebugPrivilege 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2380 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4988 wrote to memory of 764 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 8 PID 4988 wrote to memory of 768 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 9 PID 4988 wrote to memory of 384 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 13 PID 4988 wrote to memory of 2572 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 44 PID 4988 wrote to memory of 2588 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 45 PID 4988 wrote to memory of 2736 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 47 PID 4988 wrote to memory of 3352 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 55 PID 4988 wrote to memory of 3644 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 57 PID 4988 wrote to memory of 3844 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 58 PID 4988 wrote to memory of 3940 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 59 PID 4988 wrote to memory of 4004 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 60 PID 4988 wrote to memory of 2940 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 61 PID 4988 wrote to memory of 4276 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 62 PID 4988 wrote to memory of 4576 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 64 PID 4988 wrote to memory of 2448 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 76 PID 4988 wrote to memory of 1772 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 82 PID 4988 wrote to memory of 1772 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 82 PID 4988 wrote to memory of 1772 4988 b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe 82 PID 1772 wrote to memory of 2380 1772 iexplore.exe 83 PID 1772 wrote to memory of 2380 1772 iexplore.exe 83 PID 2380 wrote to memory of 3736 2380 IEXPLORE.EXE 84 PID 2380 wrote to memory of 3736 2380 IEXPLORE.EXE 84 PID 2380 wrote to memory of 3736 2380 IEXPLORE.EXE 84 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2588
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2736
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe"C:\Users\Admin\AppData\Local\Temp\b354df98bb56ecb87bf586179bbb34d09c50b8c3e9e02b2ca23ca2a771c4f9e0.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4988 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3736
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3644
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3844
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4004
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4276
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4576
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2448
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5203ddc09084e958498293f6ecef1a1e4
SHA1df8fdc39325e88a761ef4da69509b1bd8d3ef2a6
SHA256bcb41b57c4ce82debc1f42013cd577ba427df23c39b3e356678cb0cb1268020c
SHA512812d76aaf43f4884c59de4d0b6f5c9ec7493dbaf621c384a046e78f3ac3c3304943127c95a0d083f752557f9636c18f743b7be8c2e0447f7d43076ad14b62fb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD545ddc60e4743a657fe83f0ffdd09f77c
SHA1aead887b5c87ff0b6a05632a9ccfa54fe8ec01be
SHA256996016849a738586da6ef62fd4c58e2fbf88665c7466c482333e701daceee4e5
SHA51293b9a4b8ce9be16398a92119022b39b553f75950e789dc24cabab43a88c441b533015c0372b35d94bdb10bf8d1a0ab12064d727584946c79da592bcc5e8be4bd
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
1KB
MD517b0b79871387cd7cc22cbd72a0197fd
SHA122d35f8ab64d7b38cf90bcb23747a0863ee80a16
SHA256229cbdc3d275d1f84524450b37c55d6c2074c895889c9f75988168daa3c85ea0
SHA51282e66e11749087092dd71879736f2025a8a2564a13fe6688f484704e938825dfa40467f14fbb4435bccc223df15d3e00daef6746521ef19a866effd544d68008
-
Filesize
1KB
MD59666d7d69681361c8f1ee6e1352b37a1
SHA1026d01b3e9a1c8752be75f348484713f64099551
SHA2562a40e46debd9a2139f8d6bfd02b2fb15039373d67965a352c9a2c9cbe45257b0
SHA512ca6ce9f0c7cec6a409d0a5ac05df757e90fd8812c6df12fbb09144d00bca10ab3a091120f0b10de584d966e5eafba14ca8823103c594b868dce0858c9ab6d9f8
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee