Analysis
-
max time kernel
124s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2025 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
-
Size
417KB
-
MD5
20647c8fdb9685e97d672ff405ebe702
-
SHA1
4767e95b96baca189ada65f5dc4e6da290e7893f
-
SHA256
42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153
-
SHA512
341e805a3947fd76683daa959c7a7b3295645311b72eadf03b2f411324088550de1e3a325fc14a096a1f17ac997863a3aa10f083498a03877602c71a1f8d9997
-
SSDEEP
6144:8OJZ2tEYDbcgLhLwbrHRc6mRI0UdRQ525yWCc12x4qZ3wGeNq:dJGrDbcgmbjNfLdCiyW/2iqZkY
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\K: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\N: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\O: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\Z: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\G: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\H: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\I: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\Y: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\V: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\X: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\E: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\L: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\S: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\U: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\W: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\M: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\P: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\Q: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\T: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\autorun.inf 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
resource yara_rule behavioral2/memory/4052-9-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-13-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-12-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-22-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-27-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-24-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-10-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-21-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-11-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-28-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-29-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-30-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-31-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-32-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-33-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-34-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-35-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-37-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-38-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-40-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-42-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-44-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-46-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-49-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-51-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-54-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-56-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-57-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-58-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-64-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-66-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-69-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-70-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-73-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-75-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-77-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-78-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-80-0x0000000002370000-0x000000000342A000-memory.dmp upx behavioral2/memory/4052-82-0x0000000002370000-0x000000000342A000-memory.dmp upx -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\7z.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e578906 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Windows\SYSTEM.INI 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4052 wrote to memory of 784 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 8 PID 4052 wrote to memory of 788 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 9 PID 4052 wrote to memory of 384 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 13 PID 4052 wrote to memory of 2648 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 44 PID 4052 wrote to memory of 2656 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 45 PID 4052 wrote to memory of 2840 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 51 PID 4052 wrote to memory of 3520 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 56 PID 4052 wrote to memory of 3664 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 57 PID 4052 wrote to memory of 3852 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 58 PID 4052 wrote to memory of 3944 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 59 PID 4052 wrote to memory of 4008 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 60 PID 4052 wrote to memory of 4092 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 61 PID 4052 wrote to memory of 3772 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 62 PID 4052 wrote to memory of 4184 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 64 PID 4052 wrote to memory of 1644 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 76 PID 4052 wrote to memory of 1612 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 81 PID 4052 wrote to memory of 3260 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 82 PID 4052 wrote to memory of 784 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 8 PID 4052 wrote to memory of 788 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 9 PID 4052 wrote to memory of 384 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 13 PID 4052 wrote to memory of 2648 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 44 PID 4052 wrote to memory of 2656 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 45 PID 4052 wrote to memory of 2840 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 51 PID 4052 wrote to memory of 3520 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 56 PID 4052 wrote to memory of 3664 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 57 PID 4052 wrote to memory of 3852 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 58 PID 4052 wrote to memory of 3944 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 59 PID 4052 wrote to memory of 4008 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 60 PID 4052 wrote to memory of 4092 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 61 PID 4052 wrote to memory of 3772 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 62 PID 4052 wrote to memory of 4184 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 64 PID 4052 wrote to memory of 1644 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 76 PID 4052 wrote to memory of 1612 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 81 PID 4052 wrote to memory of 3260 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 82 PID 4052 wrote to memory of 3276 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 85 PID 4052 wrote to memory of 3648 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 86 PID 4052 wrote to memory of 784 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 8 PID 4052 wrote to memory of 788 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 9 PID 4052 wrote to memory of 384 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 13 PID 4052 wrote to memory of 2648 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 44 PID 4052 wrote to memory of 2656 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 45 PID 4052 wrote to memory of 2840 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 51 PID 4052 wrote to memory of 3520 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 56 PID 4052 wrote to memory of 3664 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 57 PID 4052 wrote to memory of 3852 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 58 PID 4052 wrote to memory of 3944 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 59 PID 4052 wrote to memory of 4008 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 60 PID 4052 wrote to memory of 4092 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 61 PID 4052 wrote to memory of 3772 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 62 PID 4052 wrote to memory of 4184 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 64 PID 4052 wrote to memory of 1644 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 76 PID 4052 wrote to memory of 3260 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 82 PID 4052 wrote to memory of 3276 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 85 PID 4052 wrote to memory of 3648 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 86 PID 4052 wrote to memory of 784 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 8 PID 4052 wrote to memory of 788 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 9 PID 4052 wrote to memory of 384 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 13 PID 4052 wrote to memory of 2648 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 44 PID 4052 wrote to memory of 2656 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 45 PID 4052 wrote to memory of 2840 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 51 PID 4052 wrote to memory of 3520 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 56 PID 4052 wrote to memory of 3664 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 57 PID 4052 wrote to memory of 3852 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 58 PID 4052 wrote to memory of 3944 4052 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 59 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2656
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2840
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe"C:\Users\Admin\AppData\Local\Temp\42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4052
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3664
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3852
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3944
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4008
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4092
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3772
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4184
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1644
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1612
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3260
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3276
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3648
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3140
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD5f4151753a7ef2d45b110e9139bbacd6e
SHA1392c3a07e2c609b67ddcff6824c80ad412871cb5
SHA256b9b38e93bcbc711f731b423b5350e4c3eb27970d335068aba7ceef0461cacd29
SHA51244b939a648407ae34af0df9882c1ebf549e66d9d00577bb7470fe6175159c0c1336880d39b90e23e28f4f513000b33cc482761c3b759b3a8b5686f6914fee7ec
-
C:\Users\Admin\AppData\Local\Temp\0E5788E7_Rar\42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
Filesize345KB
MD5d533436c03ff6be712d28fcacecbe14a
SHA1b9390dbd5124473156c573d5c0d96ce91c821cf6
SHA256b410163207d473babfe1f231a4f891a00e7df12ab533fbcc48de773af7765e00
SHA5128f19106df51b4b8eccdcf15f00829a49cafeb657bd935565c5b0f7ceafdaa236f59ee8ae329b02b7ab4cf73f64bb9698aab7f25535d864924d5ac0327e795ab8
-
Filesize
97KB
MD5347048fc3880253b4228c8a91e4e085f
SHA19b9ffc700163d44d7161899887e609a9de4b9a31
SHA2563c7dba0a31794655fbdfe67709beed0fd73f913c34bc7cc8fb1a912d6593333d
SHA5128c3ffe0a86702cb08b2607abeec814c078264b44b1dbf61d5792e534c9b03e1af14983683d4ec2141eb7feeb7c1b8c2b2ba627454e8771a08727bd6f83618b70