Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 00:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll
-
Size
120KB
-
MD5
eb6ac65767bdfb15721ad2097182a1b4
-
SHA1
ab920f5b87d1f3af1ca5660e4bdc7e9ee5301771
-
SHA256
b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3
-
SHA512
2e2aa483ab5701baea170896506b2e96ddda822639178707667685a109c314ae340f316f219d02afec7ba3f7944e49ce66a1e31c96d8b4de3d6fe36f03f2b273
-
SSDEEP
3072:UZWZ0zaRvsmGFSi42JcYNOPv7it2Mh+UWj1AVvlv0D3S:UZWwYvsmO9X7Oritlh+UWIdcC
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578628.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57884a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578628.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57884a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578628.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a18f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a18f.exe -
Executes dropped EXE 4 IoCs
pid Process 572 e578628.exe 2968 e57884a.exe 3856 e57a18f.exe 3208 e57a1be.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a18f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578628.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57884a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a18f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578628.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e578628.exe File opened (read-only) \??\N: e578628.exe File opened (read-only) \??\O: e578628.exe File opened (read-only) \??\R: e578628.exe File opened (read-only) \??\H: e578628.exe File opened (read-only) \??\S: e578628.exe File opened (read-only) \??\E: e578628.exe File opened (read-only) \??\K: e578628.exe File opened (read-only) \??\L: e578628.exe File opened (read-only) \??\M: e578628.exe File opened (read-only) \??\J: e578628.exe File opened (read-only) \??\P: e578628.exe File opened (read-only) \??\Q: e578628.exe File opened (read-only) \??\G: e578628.exe -
resource yara_rule behavioral2/memory/572-8-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-9-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-12-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-21-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-20-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-13-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-11-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-10-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-14-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-22-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-36-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-37-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-38-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-40-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-39-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-42-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-43-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-55-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-60-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-61-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-75-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-77-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-80-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-82-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-85-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-86-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-87-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-89-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-96-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-97-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/572-103-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/2968-131-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/2968-150-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e578628.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e578628.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e578628.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578628.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e578695 e578628.exe File opened for modification C:\Windows\SYSTEM.INI e578628.exe File created C:\Windows\e57d716 e57884a.exe File created C:\Windows\e57f02c e57a18f.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57884a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a18f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a1be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578628.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 572 e578628.exe 572 e578628.exe 572 e578628.exe 572 e578628.exe 2968 e57884a.exe 2968 e57884a.exe 3856 e57a18f.exe 3856 e57a18f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe Token: SeDebugPrivilege 572 e578628.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 4280 2904 rundll32.exe 83 PID 2904 wrote to memory of 4280 2904 rundll32.exe 83 PID 2904 wrote to memory of 4280 2904 rundll32.exe 83 PID 4280 wrote to memory of 572 4280 rundll32.exe 84 PID 4280 wrote to memory of 572 4280 rundll32.exe 84 PID 4280 wrote to memory of 572 4280 rundll32.exe 84 PID 572 wrote to memory of 820 572 e578628.exe 9 PID 572 wrote to memory of 824 572 e578628.exe 10 PID 572 wrote to memory of 388 572 e578628.exe 13 PID 572 wrote to memory of 2652 572 e578628.exe 46 PID 572 wrote to memory of 2836 572 e578628.exe 50 PID 572 wrote to memory of 2988 572 e578628.exe 51 PID 572 wrote to memory of 3380 572 e578628.exe 56 PID 572 wrote to memory of 3544 572 e578628.exe 57 PID 572 wrote to memory of 3744 572 e578628.exe 58 PID 572 wrote to memory of 3836 572 e578628.exe 59 PID 572 wrote to memory of 3904 572 e578628.exe 60 PID 572 wrote to memory of 3996 572 e578628.exe 61 PID 572 wrote to memory of 3532 572 e578628.exe 62 PID 572 wrote to memory of 4548 572 e578628.exe 64 PID 572 wrote to memory of 3644 572 e578628.exe 75 PID 572 wrote to memory of 644 572 e578628.exe 81 PID 572 wrote to memory of 2904 572 e578628.exe 82 PID 572 wrote to memory of 4280 572 e578628.exe 83 PID 572 wrote to memory of 4280 572 e578628.exe 83 PID 4280 wrote to memory of 2968 4280 rundll32.exe 85 PID 4280 wrote to memory of 2968 4280 rundll32.exe 85 PID 4280 wrote to memory of 2968 4280 rundll32.exe 85 PID 4280 wrote to memory of 3856 4280 rundll32.exe 87 PID 4280 wrote to memory of 3856 4280 rundll32.exe 87 PID 4280 wrote to memory of 3856 4280 rundll32.exe 87 PID 4280 wrote to memory of 3208 4280 rundll32.exe 88 PID 4280 wrote to memory of 3208 4280 rundll32.exe 88 PID 4280 wrote to memory of 3208 4280 rundll32.exe 88 PID 572 wrote to memory of 820 572 e578628.exe 9 PID 572 wrote to memory of 824 572 e578628.exe 10 PID 572 wrote to memory of 388 572 e578628.exe 13 PID 572 wrote to memory of 2652 572 e578628.exe 46 PID 572 wrote to memory of 2836 572 e578628.exe 50 PID 572 wrote to memory of 2988 572 e578628.exe 51 PID 572 wrote to memory of 3380 572 e578628.exe 56 PID 572 wrote to memory of 3544 572 e578628.exe 57 PID 572 wrote to memory of 3744 572 e578628.exe 58 PID 572 wrote to memory of 3836 572 e578628.exe 59 PID 572 wrote to memory of 3904 572 e578628.exe 60 PID 572 wrote to memory of 3996 572 e578628.exe 61 PID 572 wrote to memory of 3532 572 e578628.exe 62 PID 572 wrote to memory of 4548 572 e578628.exe 64 PID 572 wrote to memory of 3644 572 e578628.exe 75 PID 572 wrote to memory of 2968 572 e578628.exe 85 PID 572 wrote to memory of 2968 572 e578628.exe 85 PID 572 wrote to memory of 3856 572 e578628.exe 87 PID 572 wrote to memory of 3856 572 e578628.exe 87 PID 572 wrote to memory of 3208 572 e578628.exe 88 PID 572 wrote to memory of 3208 572 e578628.exe 88 PID 2968 wrote to memory of 820 2968 e57884a.exe 9 PID 2968 wrote to memory of 824 2968 e57884a.exe 10 PID 2968 wrote to memory of 388 2968 e57884a.exe 13 PID 2968 wrote to memory of 2652 2968 e57884a.exe 46 PID 2968 wrote to memory of 2836 2968 e57884a.exe 50 PID 2968 wrote to memory of 2988 2968 e57884a.exe 51 PID 2968 wrote to memory of 3380 2968 e57884a.exe 56 PID 2968 wrote to memory of 3544 2968 e57884a.exe 57 PID 2968 wrote to memory of 3744 2968 e57884a.exe 58 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57884a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a18f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:820
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:824
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2836
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2988
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3380
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\e578628.exeC:\Users\Admin\AppData\Local\Temp\e578628.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:572
-
-
C:\Users\Admin\AppData\Local\Temp\e57884a.exeC:\Users\Admin\AppData\Local\Temp\e57884a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\e57a18f.exeC:\Users\Admin\AppData\Local\Temp\e57a18f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:3856
-
-
C:\Users\Admin\AppData\Local\Temp\e57a1be.exeC:\Users\Admin\AppData\Local\Temp\e57a1be.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3208
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3532
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4548
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3644
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:644
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5bbc10c7ba3dfea281f7d7bfe26d31439
SHA17b0ef0df1129ac9c9073aeabd92ee94c68f68079
SHA256cbe2f240b04c1c71cea52c463d610f885a34f907ea1080a0447cf32e4d198396
SHA512489c0439f3e6fbb49da1297b49f1961a7c5b4d469be2b891a10c225f8817b305f0d816b126692acc02227ad4d6446619f6718b0a11d7589972204d5f17eaa246
-
Filesize
257B
MD5ed497adf55cfbb0b2bcca3661cf3e30c
SHA1c356c132afdf7330de9f3f000c29ddd129997cc5
SHA25605e296b834300160ace5caddf96e55221422b9349ecde34bb3f5c263c6f3175a
SHA512fb6e3806c9f3c6ab3bcd4ee1e57b9228b3eb260f8c5ce904955e217a0aa506c36e4b03c15e476fd50ded113f1822cf4a63c96cbb961b7b6c5964a327e37942ca