Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/02/2025, 07:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
120 seconds
General
-
Target
2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe
-
Size
65KB
-
MD5
cfb6ff1a8ef1f6fd60bf27aad8e1faa0
-
SHA1
d45b73510bd04925115c320a0f6c90d117ef8425
-
SHA256
2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1
-
SHA512
1127e68ed7c79c16d0c97860d7e200d6fe3705d883f9cc423a5cf9f7c59465c30749655f8f705f056b58fa3cd2afa4ac6cb172a2df35a979b7e0075216e6ea98
-
SSDEEP
1536:+s1UStb0hB07c/dWhTffm55Scmnre8bSqvvvxVRyhUd7:+xbBYqoTffm5ccmrnZvnRsUd7
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\K: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\O: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\P: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\X: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\H: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\N: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\Q: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\M: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\S: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\Z: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\E: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\I: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\J: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\T: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\U: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\V: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\W: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\G: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\L: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened (read-only) \??\R: 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened for modification F:\autorun.inf 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
resource yara_rule behavioral1/memory/3060-7-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-11-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-6-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-9-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-12-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-10-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-8-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-5-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-4-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-3-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-30-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-31-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-32-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-33-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-34-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-36-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-37-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-50-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-54-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-57-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-58-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-59-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-61-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-63-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-68-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-69-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-73-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/3060-74-0x0000000000960000-0x0000000001A1A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76b25e 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe File opened for modification C:\Windows\SYSTEM.INI 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe Token: SeDebugPrivilege 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 PID 3060 wrote to memory of 1040 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 17 PID 3060 wrote to memory of 1068 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 18 PID 3060 wrote to memory of 1112 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 20 PID 3060 wrote to memory of 888 3060 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1040
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1068
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe"C:\Users\Admin\AppData\Local\Temp\2ca3e6491cb74d751c398dab2a43832020b2b2b2680240f902504c648626e2d1.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3060
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:888
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD510aa5403165d6ef9cb69b6a09a05990a
SHA10f667d0ef91ba52b89e9c07d0bd4ac2e3c28bf3c
SHA2566cc3d5dd37a19723af4fb97abea795944f7bf0529e10cbe7628e61cac8186253
SHA51221b89cfd8e16e17aaf75e9d0d49ffb1c08220e86d5b0796498f647a2e05d9382654470f3685022e88133ef5fd76528c5c879e5a31a2538827d4a0f11a035b801