Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122N.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122N.dll
-
Size
120KB
-
MD5
24d585773a8555605d1481ece19761c0
-
SHA1
29f5b8ea6bb52f031211e7a11e9a5e524e074927
-
SHA256
2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122
-
SHA512
75eb95d8164142519c3f98813c822f4778e7f98681656336ae2fccaa8bba5f1896084b3ec11e38fb7e084c182d029a3787d8a5f62c8548787759b9346a334760
-
SSDEEP
3072:UZWZ0zaRvsmGFSi42JcYNOPv7it2Mh+UWj1AVvlv0D3:UZWwYvsmO9X7Oritlh+UWIdc
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a8a4.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578d4c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578d4c.exe -
Executes dropped EXE 3 IoCs
pid Process 4596 e578d4c.exe 548 e578f6f.exe 2500 e57a8a4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a8a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a8a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578d4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a8a4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a8a4.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e578d4c.exe File opened (read-only) \??\J: e578d4c.exe File opened (read-only) \??\N: e578d4c.exe File opened (read-only) \??\S: e578d4c.exe File opened (read-only) \??\Q: e578d4c.exe File opened (read-only) \??\E: e578d4c.exe File opened (read-only) \??\G: e578d4c.exe File opened (read-only) \??\O: e578d4c.exe File opened (read-only) \??\P: e578d4c.exe File opened (read-only) \??\R: e578d4c.exe File opened (read-only) \??\E: e57a8a4.exe File opened (read-only) \??\H: e578d4c.exe File opened (read-only) \??\K: e578d4c.exe File opened (read-only) \??\L: e578d4c.exe File opened (read-only) \??\M: e578d4c.exe -
resource yara_rule behavioral2/memory/4596-6-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-8-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-9-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-11-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-16-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-13-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-24-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-14-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-12-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-10-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-34-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-36-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-37-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-38-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-40-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-39-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-42-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-51-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-52-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-55-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-56-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-66-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-67-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-71-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-72-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-75-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-76-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-79-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-80-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-88-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-89-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4596-90-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2500-130-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/2500-156-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e578d4c.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e578d4c.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e578d4c.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578d4c.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e578da9 e578d4c.exe File opened for modification C:\Windows\SYSTEM.INI e578d4c.exe File created C:\Windows\e57deb7 e57a8a4.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a8a4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578d4c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578f6f.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4596 e578d4c.exe 4596 e578d4c.exe 4596 e578d4c.exe 4596 e578d4c.exe 2500 e57a8a4.exe 2500 e57a8a4.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe Token: SeDebugPrivilege 4596 e578d4c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4024 wrote to memory of 4756 4024 rundll32.exe 85 PID 4024 wrote to memory of 4756 4024 rundll32.exe 85 PID 4024 wrote to memory of 4756 4024 rundll32.exe 85 PID 4756 wrote to memory of 4596 4756 rundll32.exe 86 PID 4756 wrote to memory of 4596 4756 rundll32.exe 86 PID 4756 wrote to memory of 4596 4756 rundll32.exe 86 PID 4596 wrote to memory of 788 4596 e578d4c.exe 8 PID 4596 wrote to memory of 792 4596 e578d4c.exe 9 PID 4596 wrote to memory of 376 4596 e578d4c.exe 13 PID 4596 wrote to memory of 2648 4596 e578d4c.exe 44 PID 4596 wrote to memory of 2676 4596 e578d4c.exe 45 PID 4596 wrote to memory of 2808 4596 e578d4c.exe 47 PID 4596 wrote to memory of 3472 4596 e578d4c.exe 56 PID 4596 wrote to memory of 3640 4596 e578d4c.exe 57 PID 4596 wrote to memory of 3844 4596 e578d4c.exe 58 PID 4596 wrote to memory of 3940 4596 e578d4c.exe 59 PID 4596 wrote to memory of 4008 4596 e578d4c.exe 60 PID 4596 wrote to memory of 1040 4596 e578d4c.exe 61 PID 4596 wrote to memory of 3512 4596 e578d4c.exe 62 PID 4596 wrote to memory of 2292 4596 e578d4c.exe 64 PID 4596 wrote to memory of 4764 4596 e578d4c.exe 75 PID 4596 wrote to memory of 1220 4596 e578d4c.exe 77 PID 4596 wrote to memory of 2496 4596 e578d4c.exe 78 PID 4596 wrote to memory of 2304 4596 e578d4c.exe 83 PID 4596 wrote to memory of 4024 4596 e578d4c.exe 84 PID 4596 wrote to memory of 4756 4596 e578d4c.exe 85 PID 4596 wrote to memory of 4756 4596 e578d4c.exe 85 PID 4756 wrote to memory of 548 4756 rundll32.exe 87 PID 4756 wrote to memory of 548 4756 rundll32.exe 87 PID 4756 wrote to memory of 548 4756 rundll32.exe 87 PID 4756 wrote to memory of 2500 4756 rundll32.exe 88 PID 4756 wrote to memory of 2500 4756 rundll32.exe 88 PID 4756 wrote to memory of 2500 4756 rundll32.exe 88 PID 4596 wrote to memory of 788 4596 e578d4c.exe 8 PID 4596 wrote to memory of 792 4596 e578d4c.exe 9 PID 4596 wrote to memory of 376 4596 e578d4c.exe 13 PID 4596 wrote to memory of 2648 4596 e578d4c.exe 44 PID 4596 wrote to memory of 2676 4596 e578d4c.exe 45 PID 4596 wrote to memory of 2808 4596 e578d4c.exe 47 PID 4596 wrote to memory of 3472 4596 e578d4c.exe 56 PID 4596 wrote to memory of 3640 4596 e578d4c.exe 57 PID 4596 wrote to memory of 3844 4596 e578d4c.exe 58 PID 4596 wrote to memory of 3940 4596 e578d4c.exe 59 PID 4596 wrote to memory of 4008 4596 e578d4c.exe 60 PID 4596 wrote to memory of 1040 4596 e578d4c.exe 61 PID 4596 wrote to memory of 3512 4596 e578d4c.exe 62 PID 4596 wrote to memory of 2292 4596 e578d4c.exe 64 PID 4596 wrote to memory of 4764 4596 e578d4c.exe 75 PID 4596 wrote to memory of 1220 4596 e578d4c.exe 77 PID 4596 wrote to memory of 2496 4596 e578d4c.exe 78 PID 4596 wrote to memory of 548 4596 e578d4c.exe 87 PID 4596 wrote to memory of 548 4596 e578d4c.exe 87 PID 4596 wrote to memory of 2500 4596 e578d4c.exe 88 PID 4596 wrote to memory of 2500 4596 e578d4c.exe 88 PID 2500 wrote to memory of 788 2500 e57a8a4.exe 8 PID 2500 wrote to memory of 792 2500 e57a8a4.exe 9 PID 2500 wrote to memory of 376 2500 e57a8a4.exe 13 PID 2500 wrote to memory of 2648 2500 e57a8a4.exe 44 PID 2500 wrote to memory of 2676 2500 e57a8a4.exe 45 PID 2500 wrote to memory of 2808 2500 e57a8a4.exe 47 PID 2500 wrote to memory of 3472 2500 e57a8a4.exe 56 PID 2500 wrote to memory of 3640 2500 e57a8a4.exe 57 PID 2500 wrote to memory of 3844 2500 e57a8a4.exe 58 PID 2500 wrote to memory of 3940 2500 e57a8a4.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578d4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a8a4.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2676
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2808
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\e578d4c.exeC:\Users\Admin\AppData\Local\Temp\e578d4c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4596
-
-
C:\Users\Admin\AppData\Local\Temp\e578f6f.exeC:\Users\Admin\AppData\Local\Temp\e578f6f.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:548
-
-
C:\Users\Admin\AppData\Local\Temp\e57a8a4.exeC:\Users\Admin\AppData\Local\Temp\e57a8a4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2500
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3640
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3844
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4008
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3512
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2292
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4764
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1220
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2496
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2304
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5bbc10c7ba3dfea281f7d7bfe26d31439
SHA17b0ef0df1129ac9c9073aeabd92ee94c68f68079
SHA256cbe2f240b04c1c71cea52c463d610f885a34f907ea1080a0447cf32e4d198396
SHA512489c0439f3e6fbb49da1297b49f1961a7c5b4d469be2b891a10c225f8817b305f0d816b126692acc02227ad4d6446619f6718b0a11d7589972204d5f17eaa246
-
Filesize
257B
MD5caffb17615a84bd6e554b0e4766ef11b
SHA12f1cbdbc8f034f899010c9c15884e1622a68ecb9
SHA25657c2826dfea57d86e158bc062ce58740e33e38b7e5a8938c7f85a4cbcaf0e1c5
SHA512d25a6e3fc41add6dcf79e7740415147ee56ab4f5ca0400628205373e9a40d522ee29c940cf811d4310ab2ee9786a1e1ac4bba76b4454d57ff1c107538a792a51