Analysis
-
max time kernel
118s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 13:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe
-
Size
92KB
-
MD5
e19a0c053ba274cccb18224efd921e50
-
SHA1
57e397c560faf7124f77bae27b2496240a5b7e37
-
SHA256
082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5b
-
SHA512
0ed7ed78b7934c270ec00d2942640f6e1730d900bedeb52953b5299b37e299fa4901ecd254244bcdf06ab8460b83e58d7eb2657db5f47e492f60f7ab3f8b03ea
-
SSDEEP
1536:Grejjtr5s68GTBPUK5UMGjqeXugP5rU33dlhkM7hBfASWJWp/lrb+g3dh3:AgjR5s68G1chMG/P52pIShpN+Eb
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\Q: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\R: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\U: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\W: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\J: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\M: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\N: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\O: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\V: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\Z: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\E: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\H: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\I: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\K: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\P: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\S: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\T: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\L: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\X: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened (read-only) \??\Y: 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened for modification F:\autorun.inf 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
resource yara_rule behavioral1/memory/2476-4-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-7-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-6-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-27-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-28-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-3-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-29-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-5-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-26-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-32-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-33-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-8-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-34-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-35-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-36-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-38-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-39-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-40-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-41-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-42-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-44-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-45-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-55-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-56-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-59-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-60-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-62-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-65-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-66-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-69-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-71-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-72-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2476-80-0x0000000000690000-0x000000000174A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened for modification C:\Program Files\7-Zip\7z.exe 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f775cb1 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe File opened for modification C:\Windows\SYSTEM.INI 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe Token: SeDebugPrivilege 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 PID 2476 wrote to memory of 1132 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 19 PID 2476 wrote to memory of 1232 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 20 PID 2476 wrote to memory of 1280 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 21 PID 2476 wrote to memory of 1588 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 25 PID 2476 wrote to memory of 3064 2476 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe 30 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1232
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe"C:\Users\Admin\AppData\Local\Temp\082fb09787d715b2756c1df32c453839f5e5d21eba882b97733cfe863d04fb5bN.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2476
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1588
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1733009696-1058733909-388993113780833004-1439415331504544767-1980570457-822300690"1⤵PID:3064
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD552c85789f7ce3c1f345bd170f094d5b3
SHA18b795b69d9e53765afc09cb36b2f174a2bc3d371
SHA2562433b041178156e3eedd09de86901e649cd88b8135c23952f1f99f9d235315d5
SHA512d456d84c84fa191edd6fac557e8387a88b168b726afa5ffc16e1ba2c763d4cee6ab14ec667b547fe317884ce578b188fa6473ed18bbe9be9d4378b24c2cf0b70