Analysis
-
max time kernel
117s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05-02-2025 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe
-
Size
184KB
-
MD5
3f1a9574d230dc5f0e8e95c5619c3b79
-
SHA1
a52570de1a652148e6ec84e732d50ab48611b7d2
-
SHA256
9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4
-
SHA512
7fda4142952ee0cdd41ba6d8a0349391ab2b813561d18431f210194fe9d981196c2a3cef2017e10d60500640aab0a20fa3c6bc19bdb88cb1a0459102f84058c6
-
SSDEEP
3072:imZWXyaiedMbrN6LnoXPBsr5ZrAdBB7n78IXcxc0Ulqin1SPTV:iSNaPM4boo5ZUt778wcO0Ull1Sp
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\K: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\N: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\P: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\Q: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\R: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\S: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\H: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\V: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\W: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\G: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\X: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\Y: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\Z: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\E: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\J: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\L: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\M: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\O: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\T: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened (read-only) \??\U: 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened for modification F:\autorun.inf 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
resource yara_rule behavioral1/memory/816-1-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-3-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-8-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-9-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-7-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-34-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-35-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-33-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-32-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-31-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-11-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-6-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-5-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-10-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-4-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-37-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-38-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-39-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-41-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-43-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-57-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-61-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-64-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-68-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-72-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-71-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-74-0x0000000002440000-0x00000000034FA000-memory.dmp upx behavioral1/memory/816-77-0x0000000002440000-0x00000000034FA000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened for modification C:\Program Files\7-Zip\7z.exe 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe File created C:\Windows\f77b6b2 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe Token: SeDebugPrivilege 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 PID 816 wrote to memory of 1196 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 19 PID 816 wrote to memory of 1296 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 20 PID 816 wrote to memory of 1336 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 21 PID 816 wrote to memory of 1740 816 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1196
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1296
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe"C:\Users\Admin\AppData\Local\Temp\9070f7ff041aa3677a9734e9c85ee1c0d239f41e998e1b551a843a9751c56fc4.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:816
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1740
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5d41621e10e2aea536784e4a01b4f77ef
SHA150173b1c31a6d8054fc246c86b226557cbe2231e
SHA2562a0dec9d3e34cbe0271fc014c294bd49543901856961560e5bfb5bef0068df87
SHA512c2ffd91abbf72a6f7793e2a89b26c521a53fd4f9598c79941f2a0d939f3ccd47df05821d1b4f0b8942a2bfc9671e6c0abfc09041baa8a6f3a09658571d8c449f