Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-01-2025 19:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
General
-
Target
13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe
-
Size
100KB
-
MD5
1c9a1384d4e0f70c9786dfd796bee742
-
SHA1
14208800172c98ae1a7e4a974a45bcd69a5fe6a9
-
SHA256
13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2
-
SHA512
68e5d1867dc80d80a2462344ad1e0f24b4f600630263f4ed94a3cf646c6356fe00762872366559a60aa7aa94a61f13e15a032f35568d0f252b03daaf6fb661eb
-
SSDEEP
3072:Z7LbtTpMv7n8wjq+YQtW41pZGaTjm0CvX4eUkjdCdW:RbtlciNQY41XZC0AX4gdC
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Disables Task Manager via registry modification
-
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\T: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\X: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\Z: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\G: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\O: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\S: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\W: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\R: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\V: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\H: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\J: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\L: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\M: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\P: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\Q: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\Y: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\I: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\K: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\N: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened (read-only) \??\U: 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened for modification F:\autorun.inf 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
resource yara_rule behavioral1/memory/2156-29-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-28-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-27-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-26-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-25-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-7-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-5-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-4-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-3-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-8-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-6-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-1-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-30-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-31-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-32-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-34-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-35-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-44-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-46-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-47-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-49-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-51-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-54-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-56-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-58-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-59-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-62-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2156-63-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe Token: SeDebugPrivilege 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 PID 2156 wrote to memory of 1120 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 19 PID 2156 wrote to memory of 1172 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 20 PID 2156 wrote to memory of 1216 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 21 PID 2156 wrote to memory of 836 2156 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe"C:\Users\Admin\AppData\Local\Temp\13dd766a2456b2fd6b4cdf5f96d879b74ab5e704c27f4335a2e43fdbf99a39d2.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2156
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:836
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD56a94e52efbdf7faf26851d6c7b2d4c4a
SHA1696752082270d852588c89ab66904055b4e12aa4
SHA25622dcfd16fa63f2ec683352e7d18b34e67230c91733d66c4393d05a363f4115b4
SHA51291fba72bed96b24900acad067d3cb0ca112e427df09d95e227a7b106e134583de028760788d51e2aa55c6e1f2aa364dc4cf363d8a8a9b9e75b9b93935426b7d7