Analysis
-
max time kernel
120s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-02-2025 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
120 seconds
General
-
Target
7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe
-
Size
97KB
-
MD5
90de0de24c48c326fc46485652e8e15f
-
SHA1
60f6439208d303080f96c39fc438ed29e3c84e1b
-
SHA256
7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689
-
SHA512
2b3870b5df6fe64b5cbe917bc12d071dd986f7a2c047218ef2bb36902ed9fe154b026a7207a336b8382b1f3d9710270a6cf2a3e809247761ba54d3f44b1163fa
-
SSDEEP
1536:MfRUxQPRCRpYUAeQQQJ+CnWofqKWUHgfT+pDtqAJzWV5ywiHlu1Cp:MSxMksUilWKWUGKfJ65ywi4sp
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\K: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\N: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\P: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\S: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\Y: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\E: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\I: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\T: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\V: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\M: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\O: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\Q: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\R: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\W: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\X: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\G: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\J: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\L: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\U: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened (read-only) \??\Z: 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened for modification F:\autorun.inf 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
resource yara_rule behavioral1/memory/1748-8-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-1-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-11-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-7-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-5-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-12-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-4-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-3-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-10-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-6-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-9-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-32-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-33-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-34-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-35-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-36-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-38-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-39-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-40-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-42-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-44-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-45-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-48-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-65-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-68-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-72-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-75-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-76-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/1748-79-0x0000000000660000-0x000000000171A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe File created C:\Windows\f768bdb 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe Token: SeDebugPrivilege 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 PID 1748 wrote to memory of 1112 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 19 PID 1748 wrote to memory of 1160 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 20 PID 1748 wrote to memory of 1200 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 21 PID 1748 wrote to memory of 836 1748 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe"C:\Users\Admin\AppData\Local\Temp\7c8a3985052cd8e8053f42d6173e81f4f98f67b7b27f38de1441e03741c9f689.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1748
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:836
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5a25a076523cf24d7b723afb81cc8f5de
SHA186c8090b35d07f6fd005eb2ef21315650991d3c6
SHA2567393935a85ae44b61b741c78dbadbf2e166b2afbbda93fd4eec4429a27e60496
SHA512477ef50f52e45e48e34c11ba5bc56ddc7da96d9f9fccddc7ca829a00ade37057455def703991261f06da42c7d5225901ca1b24f8cb35ea5dba08db9cc8faf38e