Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 09:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2997a852ab69a853bd89984fa565602fc56f35cad991d8d433c164949d48cabb.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
2997a852ab69a853bd89984fa565602fc56f35cad991d8d433c164949d48cabb.dll
-
Size
120KB
-
MD5
1fae1302799e92ea43cd1b5cb9350ab9
-
SHA1
6293e3d25982b7f0ce4a1c780722cffd71f61853
-
SHA256
2997a852ab69a853bd89984fa565602fc56f35cad991d8d433c164949d48cabb
-
SHA512
254bf12d4a3e6642fee1712b63e219813f529a9fe52e84b3d33fd5eea7033fe034486bbc25ba1d94d0a8bb84fe03d41329b93e6b9fe30b0c6ceeaa74d5a3d52a
-
SSDEEP
1536:Ug/JzJ21qktSQN/XJvmqvIALdDAvZfBFOpwY/a3p9YoQ8VNieAhE8Ja3Rt:z/FJ2ntSQN/Xhmqvz+ffwa5PIeAhEFb
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b396.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b396.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cf41.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cf41.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cf41.exe -
Executes dropped EXE 3 IoCs
pid Process 972 f76b396.exe 2632 f76b54b.exe 1628 f76cf41.exe -
Loads dropped DLL 6 IoCs
pid Process 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b54b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b54b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cf41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b396.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b396.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cf41.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: f76b396.exe File opened (read-only) \??\I: f76b396.exe File opened (read-only) \??\L: f76b396.exe File opened (read-only) \??\M: f76b396.exe File opened (read-only) \??\O: f76b396.exe File opened (read-only) \??\P: f76b396.exe File opened (read-only) \??\T: f76b396.exe File opened (read-only) \??\G: f76b396.exe File opened (read-only) \??\H: f76b396.exe File opened (read-only) \??\J: f76b396.exe File opened (read-only) \??\N: f76b396.exe File opened (read-only) \??\R: f76b396.exe File opened (read-only) \??\E: f76b396.exe File opened (read-only) \??\K: f76b396.exe File opened (read-only) \??\S: f76b396.exe -
resource yara_rule behavioral1/memory/972-13-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-18-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-21-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-16-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-15-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-17-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-20-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-23-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-22-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-19-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-64-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-65-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-66-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-68-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-67-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-70-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-71-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-84-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-85-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-87-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-90-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/972-158-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2632-172-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2632-197-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f76b403 f76b396.exe File opened for modification C:\Windows\SYSTEM.INI f76b396.exe File created C:\Windows\f770454 f76b54b.exe File created C:\Windows\f771d8f f76cf41.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b396.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b54b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cf41.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 972 f76b396.exe 972 f76b396.exe 2632 f76b54b.exe 1628 f76cf41.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 972 f76b396.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 2632 f76b54b.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe Token: SeDebugPrivilege 1628 f76cf41.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1888 2576 rundll32.exe 30 PID 2576 wrote to memory of 1888 2576 rundll32.exe 30 PID 2576 wrote to memory of 1888 2576 rundll32.exe 30 PID 2576 wrote to memory of 1888 2576 rundll32.exe 30 PID 2576 wrote to memory of 1888 2576 rundll32.exe 30 PID 2576 wrote to memory of 1888 2576 rundll32.exe 30 PID 2576 wrote to memory of 1888 2576 rundll32.exe 30 PID 1888 wrote to memory of 972 1888 rundll32.exe 31 PID 1888 wrote to memory of 972 1888 rundll32.exe 31 PID 1888 wrote to memory of 972 1888 rundll32.exe 31 PID 1888 wrote to memory of 972 1888 rundll32.exe 31 PID 972 wrote to memory of 1056 972 f76b396.exe 18 PID 972 wrote to memory of 1100 972 f76b396.exe 19 PID 972 wrote to memory of 1180 972 f76b396.exe 21 PID 972 wrote to memory of 2040 972 f76b396.exe 23 PID 972 wrote to memory of 2576 972 f76b396.exe 29 PID 972 wrote to memory of 1888 972 f76b396.exe 30 PID 972 wrote to memory of 1888 972 f76b396.exe 30 PID 1888 wrote to memory of 2632 1888 rundll32.exe 32 PID 1888 wrote to memory of 2632 1888 rundll32.exe 32 PID 1888 wrote to memory of 2632 1888 rundll32.exe 32 PID 1888 wrote to memory of 2632 1888 rundll32.exe 32 PID 1888 wrote to memory of 1628 1888 rundll32.exe 34 PID 1888 wrote to memory of 1628 1888 rundll32.exe 34 PID 1888 wrote to memory of 1628 1888 rundll32.exe 34 PID 1888 wrote to memory of 1628 1888 rundll32.exe 34 PID 972 wrote to memory of 1056 972 f76b396.exe 18 PID 972 wrote to memory of 1100 972 f76b396.exe 19 PID 972 wrote to memory of 1180 972 f76b396.exe 21 PID 972 wrote to memory of 2040 972 f76b396.exe 23 PID 972 wrote to memory of 2632 972 f76b396.exe 32 PID 972 wrote to memory of 2632 972 f76b396.exe 32 PID 972 wrote to memory of 1628 972 f76b396.exe 34 PID 972 wrote to memory of 1628 972 f76b396.exe 34 PID 2632 wrote to memory of 1056 2632 f76b54b.exe 18 PID 2632 wrote to memory of 1100 2632 f76b54b.exe 19 PID 2632 wrote to memory of 1180 2632 f76b54b.exe 21 PID 2632 wrote to memory of 2040 2632 f76b54b.exe 23 PID 1628 wrote to memory of 1056 1628 f76cf41.exe 18 PID 1628 wrote to memory of 1100 1628 f76cf41.exe 19 PID 1628 wrote to memory of 1180 1628 f76cf41.exe 21 PID 1628 wrote to memory of 2040 1628 f76cf41.exe 23 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b396.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cf41.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1056
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1100
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2997a852ab69a853bd89984fa565602fc56f35cad991d8d433c164949d48cabb.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2997a852ab69a853bd89984fa565602fc56f35cad991d8d433c164949d48cabb.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\f76b396.exeC:\Users\Admin\AppData\Local\Temp\f76b396.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\f76b54b.exeC:\Users\Admin\AppData\Local\Temp\f76b54b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\f76cf41.exeC:\Users\Admin\AppData\Local\Temp\f76cf41.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1628
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2040
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD571e5c499536d487608f671dd4e076cee
SHA1981bd7001f5f5cb8558e38acbf63194f14a724ac
SHA256fcf7d3af8f9e87b04e20a1c71511ba939a6f6fc4c4a703d31a32420a522b13f9
SHA512bce83775eaf9dc1be93823051bb2bf4f96230e099a6413bb086490cbc55f16a662331bf836fa3b9d2c3103cb3909dfd19c2e20b193d3941ed40e6f97b775cdeb
-
Filesize
97KB
MD538a7367776b3770f2e42e9087fe531af
SHA155e971b8769062d98731c074094b78fe4494dd34
SHA256f6307a5cb91762f54042cf91280fa402fa965412dcc7d43f5b245622c6d8a2af
SHA512ab6ac39836e226cebf062468015f9845e6fbe66f631afb87fa8505e4602e0082f1312a898a100003d3d70d7f6126979999543cecf2a3b51132d8f649dc372eda