Analysis
-
max time kernel
20s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 18:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
120 seconds
General
-
Target
f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe
-
Size
128KB
-
MD5
7aa1a3c26b81c67bcd15e6453d7e9ed0
-
SHA1
facec43ee5eccac060fdd434c7f1530621eb2f7e
-
SHA256
f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66
-
SHA512
d6e025886b43d5d203aa51d19bd20fc127d43bc7c35018639c9eaed47daeb26f360e6f51b8778b2c8ddd23754dcaea4a67b8cfc0c0152c81599281c0eaa1e8b4
-
SSDEEP
1536:1Jf83W8W60IL26Ap8iJ9+pvI8B8FuuKk1p0AxQjKP3xNL+vljZuIkBbmFZ3Oz+Ua:1JCD548iJK+cDm0KNxkllFFxOFdc
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" Fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" SVIQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" dc.exe -
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Fun.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Fun.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Fun.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe -
Deletes itself 1 IoCs
pid Process 1872 Fun.exe -
Executes dropped EXE 3 IoCs
pid Process 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe -
Loads dropped DLL 2 IoCs
pid Process 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Fun.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" SVIQ.EXE -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Fun.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Fun.exe File opened (read-only) \??\E: f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened (read-only) \??\E: Fun.exe File opened (read-only) \??\G: Fun.exe File opened (read-only) \??\H: Fun.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\Win.exe dc.exe File created C:\Windows\SysWOW64\WinSit.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe Fun.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe Fun.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe dc.exe File created C:\Windows\SysWOW64\config\Win.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\config\Win.exe SVIQ.EXE -
resource yara_rule behavioral1/memory/2800-7-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-12-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-4-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-9-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-10-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-8-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-6-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-3-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-30-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-5-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-31-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-128-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-135-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-134-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/2800-138-0x00000000026A0000-0x000000000372E000-memory.dmp upx behavioral1/memory/1872-159-0x0000000004E40000-0x0000000005ECE000-memory.dmp upx behavioral1/memory/1872-157-0x0000000004E40000-0x0000000005ECE000-memory.dmp upx behavioral1/memory/1872-158-0x0000000004E40000-0x0000000005ECE000-memory.dmp upx behavioral1/memory/1872-153-0x0000000004E40000-0x0000000005ECE000-memory.dmp upx behavioral1/memory/1872-216-0x0000000004E40000-0x0000000005ECE000-memory.dmp upx -
Drops file in Windows directory 35 IoCs
description ioc Process File created C:\Windows\SVIQ.EXE f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\SVIQ.EXE f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File created C:\Windows\Help\Other.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\inf\Other.exe Fun.exe File created C:\Windows\system\Fun.exe dc.exe File opened for modification C:\Windows\system\Fun.exe dc.exe File created C:\Windows\inf\Other.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\inf\Other.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\dc.exe SVIQ.EXE File opened for modification C:\Windows\wininit.ini SVIQ.EXE File created C:\Windows\dc.exe dc.exe File opened for modification C:\Windows\SVIQ.exe SVIQ.EXE File opened for modification C:\Windows\dc.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\Help\Other.exe dc.exe File opened for modification C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\dc.exe dc.exe File created C:\Windows\system\Fun.exe SVIQ.EXE File created C:\Windows\SVIQ.EXE SVIQ.EXE File opened for modification C:\Windows\inf\Other.exe dc.exe File opened for modification C:\Windows\wininit.ini dc.exe File opened for modification C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\system\Fun.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\SVIQ.EXE Fun.exe File opened for modification C:\Windows\dc.exe Fun.exe File opened for modification C:\Windows\Help\Other.exe Fun.exe File opened for modification C:\Windows\wininit.ini f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\inf\Other.exe SVIQ.EXE File created C:\Windows\SVIQ.EXE dc.exe File opened for modification C:\Windows\SYSTEM.INI f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File created C:\Windows\system\Fun.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File created C:\Windows\dc.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File opened for modification C:\Windows\Help\Other.exe f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe File created C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\wininit.ini Fun.exe File opened for modification C:\Windows\Help\Other.exe SVIQ.EXE -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVIQ.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe 1872 Fun.exe 888 SVIQ.EXE 2912 dc.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe Token: SeDebugPrivilege 1872 Fun.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 1872 Fun.exe 1872 Fun.exe 888 SVIQ.EXE 888 SVIQ.EXE 2912 dc.exe 2912 dc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2800 wrote to memory of 1100 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 19 PID 2800 wrote to memory of 1152 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 20 PID 2800 wrote to memory of 1184 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 21 PID 2800 wrote to memory of 784 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 25 PID 2800 wrote to memory of 1872 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 30 PID 2800 wrote to memory of 1872 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 30 PID 2800 wrote to memory of 1872 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 30 PID 2800 wrote to memory of 1872 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 30 PID 1872 wrote to memory of 888 1872 Fun.exe 31 PID 1872 wrote to memory of 888 1872 Fun.exe 31 PID 1872 wrote to memory of 888 1872 Fun.exe 31 PID 1872 wrote to memory of 888 1872 Fun.exe 31 PID 2800 wrote to memory of 2912 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 32 PID 2800 wrote to memory of 2912 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 32 PID 2800 wrote to memory of 2912 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 32 PID 2800 wrote to memory of 2912 2800 f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe 32 PID 1872 wrote to memory of 1100 1872 Fun.exe 19 PID 1872 wrote to memory of 1152 1872 Fun.exe 20 PID 1872 wrote to memory of 1184 1872 Fun.exe 21 PID 1872 wrote to memory of 784 1872 Fun.exe 25 PID 1872 wrote to memory of 888 1872 Fun.exe 31 PID 1872 wrote to memory of 888 1872 Fun.exe 31 PID 1872 wrote to memory of 2912 1872 Fun.exe 32 PID 1872 wrote to memory of 2912 1872 Fun.exe 32 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Fun.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1152
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe"C:\Users\Admin\AppData\Local\Temp\f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66N.exe"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2800 -
C:\Windows\system\Fun.exeC:\Windows\system\Fun.exe3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1872 -
C:\Windows\SVIQ.EXEC:\Windows\SVIQ.EXE4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:888
-
-
-
C:\Windows\dc.exeC:\Windows\dc.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Windows\system\Fun.exeC:\Windows\system\Fun.exe4⤵PID:2172
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:784
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD57aa1a3c26b81c67bcd15e6453d7e9ed0
SHA1facec43ee5eccac060fdd434c7f1530621eb2f7e
SHA256f9d76688b45a05c9210393cfd48a4c65981591177b64c7b921e267551c1e7b66
SHA512d6e025886b43d5d203aa51d19bd20fc127d43bc7c35018639c9eaed47daeb26f360e6f51b8778b2c8ddd23754dcaea4a67b8cfc0c0152c81599281c0eaa1e8b4
-
Filesize
257B
MD52b2f27d81ed2cd984476b77024773fd7
SHA1adc5fddb41c6d7a61f26da100c890ebafaca6d6e
SHA25690d858709aa114111e826017092da13ca21e7627ddaf28c3f824a7e42c8e7237
SHA5123dee76f58c59ac2ca613ea449e185b62a6e02ed4f0f130b97069c60b0926e65e058646a8c8efea152b9b9ea19364b72fd7814dba031c648ce6ae623bf18daa88
-
Filesize
41B
MD5e839977c0d22c9aa497b0b1d90d8a372
SHA1b5048e501399138796b38f3d3666e1a88c397e83
SHA256478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2
SHA5124c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d