Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 05:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
120 seconds
General
-
Target
83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe
-
Size
416KB
-
MD5
5eada170dd29ecd50a783d0877e6f022
-
SHA1
d79443bc32e06f098a2f9449c02703e83b0705d5
-
SHA256
83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749
-
SHA512
8f27265ccfe24422027791076ef9b6f4cdfb011f2f1cb1b3b1bb5c5559f391cf23f2f6ec0ec4334063c6574f43b4fa4a15048c426d1173e4a71f51914c7d390c
-
SSDEEP
6144:UFfDAEl3nOvkGe/DDWGszKjV1eNHkG+ovUM3ep3DWhvhlWOAB:kwGDWGszKjV1eWGL5epTWhvhl1K
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe -
Loads dropped DLL 16 IoCs
pid Process 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe 2056 msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\Z: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\N: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\V: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\H: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\U: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\J: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\K: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\T: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\W: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\O: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\Q: 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
resource yara_rule behavioral1/memory/1508-18-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-1-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-19-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-22-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-25-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-23-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-24-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-16-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-17-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-15-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-82-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-81-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-83-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-84-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-85-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-87-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-88-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-90-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-91-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-92-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-95-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-113-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-114-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral1/memory/1508-215-0x0000000002470000-0x000000000352A000-memory.dmp upx -
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\MSECACHE\WICU3\MsiZapU.exe wscript.exe File created C:\Program Files (x86)\MSECACHE\WICU3\Ansi\MsiZap.exe msiexec.exe File created C:\Program Files (x86)\Windows Installer Clean Up\readme.txt msiexec.exe File created C:\Program Files (x86)\MSECACHE\WICU3\MsiZapA.exe wscript.exe File created C:\Program Files (x86)\MSECACHE\WICU3\readme.txt wscript.exe File created C:\Program Files (x86)\MSECACHE\WICU3\Unicode\MsiZap.exe msiexec.exe File created C:\Program Files (x86)\Windows Installer Clean Up\msicuu.exe msiexec.exe File created C:\Program Files (x86)\Windows Installer Clean Up\MsiZap.exe msiexec.exe File created C:\Program Files (x86)\MSECACHE\WICU3\msicuu.exe wscript.exe File opened for modification C:\Program Files (x86)\MSECACHE\WICU3\msicuu.exe wscript.exe File created C:\Program Files (x86)\MSECACHE\WICU3\msicuu.msi wscript.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\f76e485 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened for modification C:\Windows\SYSTEM.INI 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f774a59.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f774a59.msi msiexec.exe File created C:\Windows\Installer\f774a5a.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4B33.tmp msiexec.exe File created C:\Windows\Installer\f774a5c.msi msiexec.exe File opened for modification C:\Windows\Installer\f774a5a.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 2876 msiexec.exe 2876 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeShutdownPrivilege 2056 msiexec.exe Token: SeIncreaseQuotaPrivilege 2056 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeSecurityPrivilege 2876 msiexec.exe Token: SeCreateTokenPrivilege 2056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2056 msiexec.exe Token: SeLockMemoryPrivilege 2056 msiexec.exe Token: SeIncreaseQuotaPrivilege 2056 msiexec.exe Token: SeMachineAccountPrivilege 2056 msiexec.exe Token: SeTcbPrivilege 2056 msiexec.exe Token: SeSecurityPrivilege 2056 msiexec.exe Token: SeTakeOwnershipPrivilege 2056 msiexec.exe Token: SeLoadDriverPrivilege 2056 msiexec.exe Token: SeSystemProfilePrivilege 2056 msiexec.exe Token: SeSystemtimePrivilege 2056 msiexec.exe Token: SeProfSingleProcessPrivilege 2056 msiexec.exe Token: SeIncBasePriorityPrivilege 2056 msiexec.exe Token: SeCreatePagefilePrivilege 2056 msiexec.exe Token: SeCreatePermanentPrivilege 2056 msiexec.exe Token: SeBackupPrivilege 2056 msiexec.exe Token: SeRestorePrivilege 2056 msiexec.exe Token: SeShutdownPrivilege 2056 msiexec.exe Token: SeDebugPrivilege 2056 msiexec.exe Token: SeAuditPrivilege 2056 msiexec.exe Token: SeSystemEnvironmentPrivilege 2056 msiexec.exe Token: SeChangeNotifyPrivilege 2056 msiexec.exe Token: SeRemoteShutdownPrivilege 2056 msiexec.exe Token: SeUndockPrivilege 2056 msiexec.exe Token: SeSyncAgentPrivilege 2056 msiexec.exe Token: SeEnableDelegationPrivilege 2056 msiexec.exe Token: SeManageVolumePrivilege 2056 msiexec.exe Token: SeImpersonatePrivilege 2056 msiexec.exe Token: SeCreateGlobalPrivilege 2056 msiexec.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeDebugPrivilege 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe Token: SeBackupPrivilege 2936 vssvc.exe Token: SeRestorePrivilege 2936 vssvc.exe Token: SeAuditPrivilege 2936 vssvc.exe Token: SeBackupPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2056 msiexec.exe 2056 msiexec.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 1048 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 17 PID 1508 wrote to memory of 1076 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 19 PID 1508 wrote to memory of 1120 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 20 PID 1508 wrote to memory of 1236 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 25 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 1508 wrote to memory of 2776 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 31 PID 2776 wrote to memory of 2056 2776 wscript.exe 32 PID 2776 wrote to memory of 2056 2776 wscript.exe 32 PID 2776 wrote to memory of 2056 2776 wscript.exe 32 PID 2776 wrote to memory of 2056 2776 wscript.exe 32 PID 2776 wrote to memory of 2056 2776 wscript.exe 32 PID 2776 wrote to memory of 2056 2776 wscript.exe 32 PID 2776 wrote to memory of 2056 2776 wscript.exe 32 PID 1508 wrote to memory of 1048 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 17 PID 1508 wrote to memory of 1076 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 19 PID 1508 wrote to memory of 1120 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 20 PID 1508 wrote to memory of 1236 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 25 PID 1508 wrote to memory of 2056 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 32 PID 1508 wrote to memory of 2056 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 32 PID 1508 wrote to memory of 1048 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 17 PID 1508 wrote to memory of 1076 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 19 PID 1508 wrote to memory of 1120 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 20 PID 1508 wrote to memory of 1236 1508 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1048
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1076
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe"C:\Users\Admin\AppData\Local\Temp\83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1508 -
C:\Windows\SysWOW64\wscript.exewscript StartMsi.vbs3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Program Files (x86)\MSECACHE\WICU3\msicuu.msi"4⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2056
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1236
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000055C" "00000000000002FC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1628
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD52fa4cb5fe4e93437a762bc9021ea800d
SHA1712614f2e21c359cf517e6b3aeb7079b9ab50deb
SHA256872c70f8a0606e11d3a5f86392ea74f843ce25e09bfc87cfef21aa2ba1aeac02
SHA5121953f0e5bf131482fa72af9b83367223d934c66306911d6c467ac90ee61df74c47aabf70c1d7fbcfd3f3f82bb7a7a7d909d46487560933682dbff249a000b806
-
Filesize
78KB
MD58ff91f846a078660b415d84bba98a003
SHA1cf3232b306f7fd00fbe33409012bf28a386c8bfe
SHA256f5b33d62b517b354c63a3a50f1e4859a9359d9f60c6e4408179960b4c15c5bcb
SHA512db7b2c9c01b109d466c0f30855428897a139f7448486bacbbca211ff2bf72a75eb2937a0f1315850be592893afccc058e1e32a7f0d874114a8148180fb37670d
-
Filesize
92KB
MD527d4bcc325306b1415a89de550528e04
SHA1bd3bd0bb8d2ec2637b1b74eb9bffa49da7ff3ce9
SHA256c8089b1734f68420e912978ac0dd29d8772b1f527d2bffbaaa9d3fad9f4051e5
SHA512d8c398e84a884a2c0d7b38022b76a46868e3e3ad0a01b7ba188c7fff208a4c79c1c31c14b6053f4f029c59b15c9bf01e145fb1c7f7dcb633c33c2c88428bc9a6
-
Filesize
1KB
MD571659e46173f3041a062e7a6893214dd
SHA1cea2db630e0af7072515b1127f24782d7870138f
SHA2562cf0d207aeb3e0b06d12082010d8477e8ad3e6fdbfbfbc24c131c605630b26dd
SHA512d4c0f72c2a70c85e71a9990aa43fa9c1e655745303cae0938b0509a952861f00e29e354f5c39cbe7687929da8014bd8c1fa854d66f4284591253018a8abad7f2
-
Filesize
40KB
MD506109701320fb25f00e004110676a6f2
SHA16b12c026ab9ef82c6616338a7c0d4e21eb76bf2d
SHA2565900ff42650c5588e005bea236783f0a5542e4c062ef37dd26cf073d233d287d
SHA512190eab99b946dbce16ec140bf1b7ef30b7b5d14d30e2b9e05c41951e2f34cceb268ddd0e2032e3137d327016002d2c059e7d040a446c4733f59ed6b521d82418
-
Filesize
461KB
MD53dd4ddbf695ee30ef83e5ef4e40ae3fe
SHA17d875c34100a56be3c37d962dc62668799b67dd6
SHA2566a83d34425923cd78c56b6970e237fa70702679d1ed84c3057ac38a4bb83f90d
SHA51232d8f6ffee7ee5e8feaa22023fc3363a8c9733479288ed2db29d9260f1ff5b8306d12d084a51cc575901e42a9d457f339d953ce3697daf108389808add0c94ff
-
Filesize
6KB
MD531f061b4053a587c987096ed824eff76
SHA1bf1c6c30bb85cae5976662503404fe92c19d3bf1
SHA2568d1fe9d8241d4b15e57f067c55a6d770cdad994fedc050aa3891e74edcf935da
SHA512234b1999476d1a3c6257d3f4925be845db90c626df5cd59634bb5aca8cc9d78966044ddce73cf5bc1b12c242bdabcd75335640271a5e4295ce8f3b035eea3be5