Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
20s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2025, 23:48
Static task
static1
Behavioral task
behavioral1
Sample
639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe
Resource
win7-20240903-en
General
-
Target
639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe
-
Size
1.9MB
-
MD5
3bb33439e5fd17b32587abac4461c2a9
-
SHA1
3eae5af86b5bb471d59e9e587bb527710a255f7e
-
SHA256
639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c
-
SHA512
ef3e27dbb480b9e5c1388eac01c72479397542a0431b3c27060b575f83d3eda19ff557b8520a1749e6ad82504d40234b0d45b0977dc118227119aabafb9c66b4
-
SSDEEP
24576:JzYcWpbiQMobokEyEsEesVAqLJiZvqyrC9FNNaxXGrlwIB87qhZUFd4XH4eRCyDm:J58uIokSsvT26BECKfSo3oBAXRTcZIe
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Au_.exe -
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe -
Deletes itself 1 IoCs
pid Process 4684 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 4684 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 4684 Au_.exe 4684 Au_.exe 4684 Au_.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Au_.exe File opened (read-only) \??\G: Au_.exe File opened (read-only) \??\H: Au_.exe File opened (read-only) \??\I: Au_.exe -
resource yara_rule behavioral2/memory/3324-10-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-9-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-8-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-11-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-7-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-28-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-5-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-6-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-1-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-3-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/3324-4-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4684-161-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-168-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-167-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-169-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-166-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-159-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-162-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-160-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-158-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-171-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-172-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-174-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-175-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-176-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-178-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-179-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-180-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-182-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-184-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-185-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-187-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-190-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-192-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-194-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-196-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-198-0x0000000004480000-0x000000000550E000-memory.dmp upx behavioral2/memory/4684-201-0x0000000004480000-0x000000000550E000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 4684 Au_.exe 4684 Au_.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Token: SeDebugPrivilege 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3324 wrote to memory of 796 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 9 PID 3324 wrote to memory of 792 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 10 PID 3324 wrote to memory of 64 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 13 PID 3324 wrote to memory of 768 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 51 PID 3324 wrote to memory of 3124 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 52 PID 3324 wrote to memory of 3160 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 53 PID 3324 wrote to memory of 3396 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 56 PID 3324 wrote to memory of 3532 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 57 PID 3324 wrote to memory of 3728 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 58 PID 3324 wrote to memory of 3824 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 59 PID 3324 wrote to memory of 3900 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 60 PID 3324 wrote to memory of 4020 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 61 PID 3324 wrote to memory of 3412 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 62 PID 3324 wrote to memory of 3528 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 75 PID 3324 wrote to memory of 4472 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 76 PID 3324 wrote to memory of 1492 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 80 PID 3324 wrote to memory of 4256 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 81 PID 3324 wrote to memory of 4176 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 82 PID 3324 wrote to memory of 4272 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 84 PID 3324 wrote to memory of 4684 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 85 PID 3324 wrote to memory of 4684 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 85 PID 3324 wrote to memory of 4684 3324 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe 85 PID 4684 wrote to memory of 796 4684 Au_.exe 9 PID 4684 wrote to memory of 792 4684 Au_.exe 10 PID 4684 wrote to memory of 64 4684 Au_.exe 13 PID 4684 wrote to memory of 768 4684 Au_.exe 51 PID 4684 wrote to memory of 3124 4684 Au_.exe 52 PID 4684 wrote to memory of 3160 4684 Au_.exe 53 PID 4684 wrote to memory of 3396 4684 Au_.exe 56 PID 4684 wrote to memory of 3532 4684 Au_.exe 57 PID 4684 wrote to memory of 3728 4684 Au_.exe 58 PID 4684 wrote to memory of 3824 4684 Au_.exe 59 PID 4684 wrote to memory of 3900 4684 Au_.exe 60 PID 4684 wrote to memory of 4020 4684 Au_.exe 61 PID 4684 wrote to memory of 3412 4684 Au_.exe 62 PID 4684 wrote to memory of 3528 4684 Au_.exe 75 PID 4684 wrote to memory of 4472 4684 Au_.exe 76 PID 4684 wrote to memory of 1492 4684 Au_.exe 80 PID 4684 wrote to memory of 4272 4684 Au_.exe 84 PID 4684 wrote to memory of 4756 4684 Au_.exe 86 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3124
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe"C:\Users\Admin\AppData\Local\Temp\639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4684
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3532
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3728
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3824
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4020
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3412
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3528
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4472
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1492
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4256
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:4176
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4272
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4756
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD56e1b0d60c0fec9a30712232ac80f588f
SHA1a8d4e798a69554fb799131d921b8d66bb7a157d4
SHA256990b09016ea75138a1ab9c52f346ae60f97bed659aafded41c4e7c866f7a482c
SHA512e8c38e2b0e3a2617e3204e9287f82d1910ad553044156db738d33f69d5d559a9a986a6c1cdee90e10909816f3962b3c475b5340c7d8350b43ebcdcfa1d9ca54b
-
Filesize
11KB
MD5959ea64598b9a3e494c00e8fa793be7e
SHA140f284a3b92c2f04b1038def79579d4b3d066ee0
SHA25603cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
SHA5125e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
-
Filesize
812KB
MD51a9ae6a7e975fa3c77304cd8abbfb10c
SHA11f56bb9fff55822e271aad3880f43b87a5c8dee4
SHA256254e830f1fd1fa00a93cd7fa089df419f3580cfc171e0399820f4a2ec7671807
SHA512b78672fd63e26bdb2b16d6e99b506a180b980ff354890180f49a0ad4e2ddf7f58c696a7e268f5a58ae6f5d8f592a233cb68c0e59184f82b848acd7d663f404e1
-
Filesize
721B
MD5512fbfea0e6d192dc846d9b49d3716cc
SHA15c29844ae6da67904e21460fe027a78aa5a411e3
SHA25624395fa7e2c02ae3d32b2f3575a1433aed05a87674b586f34ada84b538f234fb
SHA51210c6737897110dd48e42c94e2c7ce6ad6988ba8d5e9830917f5375068765886bf85014ef3b7b36c7ae0a48b78e42601d69756ade1de1e1852b08c3a41263d580
-
Filesize
1.9MB
MD53bb33439e5fd17b32587abac4461c2a9
SHA13eae5af86b5bb471d59e9e587bb527710a255f7e
SHA256639c5053b060176ae34d35d3d81a0d51d93d5ec06dce6c6a743e0e39ebe5303c
SHA512ef3e27dbb480b9e5c1388eac01c72479397542a0431b3c27060b575f83d3eda19ff557b8520a1749e6ad82504d40234b0d45b0977dc118227119aabafb9c66b4
-
Filesize
257B
MD503667225e6607f7c7d59dc2f5474c69a
SHA16079ed3a4c0209ff5ed085d9b6f0cc5d354be945
SHA2565f13fa4ea87c7eaf5630334a79c66c5b636801e9cfe1a7746d5e0e8e54ed1219
SHA5125a1ce1a0ef094db4f52c4ac277a073d1b65736d85fde36cbd5213d4d7e2d3963b93700a74d8bcd8bf680367331521e28a0fde0384aef8502424580cc3d8ad0f5
-
Filesize
100KB
MD597595e3bad1f9e40eb80ea0036f1a7be
SHA113709b229ba486271214914ff9aeabff01198504
SHA256047c6f29354578bf8ad71dc377d539f0f0fc9922d53a07fa2a42cd209b3b6fb4
SHA512431950aee678046489c509814fda77109b6ed4c8ef39a88254290ec0be2519badef0c4466e63ada1e47277069efe575c319bd52ce3cdaadb2658db90d14d5c5f