Analysis
-
max time kernel
127s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-02-2025 06:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
-
Size
417KB
-
MD5
20647c8fdb9685e97d672ff405ebe702
-
SHA1
4767e95b96baca189ada65f5dc4e6da290e7893f
-
SHA256
42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153
-
SHA512
341e805a3947fd76683daa959c7a7b3295645311b72eadf03b2f411324088550de1e3a325fc14a096a1f17ac997863a3aa10f083498a03877602c71a1f8d9997
-
SSDEEP
6144:8OJZ2tEYDbcgLhLwbrHRc6mRI0UdRQ525yWCc12x4qZ3wGeNq:dJGrDbcgmbjNfLdCiyW/2iqZkY
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\I: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\K: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\O: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\V: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\E: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\P: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\U: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\X: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\J: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\L: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\M: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\Q: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\T: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\Z: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\H: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\N: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\R: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\W: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened (read-only) \??\Y: 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification F:\autorun.inf 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
resource yara_rule behavioral1/memory/1928-3-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-5-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-7-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-10-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-8-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-12-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-9-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-14-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-13-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-11-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-41-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-43-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-42-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-44-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-45-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-47-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-48-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-49-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-52-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-55-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-57-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-66-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-69-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-72-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-76-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-78-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-85-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-87-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx behavioral1/memory/1928-89-0x0000000001DB0000-0x0000000002E6A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\7z.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76d4bd 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe File opened for modification C:\Windows\SYSTEM.INI 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe Token: SeDebugPrivilege 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 PID 1928 wrote to memory of 1100 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 19 PID 1928 wrote to memory of 1172 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 20 PID 1928 wrote to memory of 1248 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 21 PID 1928 wrote to memory of 1496 1928 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe"C:\Users\Admin\AppData\Local\Temp\42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1496
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F76D614_Rar\42b6dba82428f2c91c2caece265900ab79bf12be141360b73fe0f95b34486153.exe
Filesize345KB
MD5d533436c03ff6be712d28fcacecbe14a
SHA1b9390dbd5124473156c573d5c0d96ce91c821cf6
SHA256b410163207d473babfe1f231a4f891a00e7df12ab533fbcc48de773af7765e00
SHA5128f19106df51b4b8eccdcf15f00829a49cafeb657bd935565c5b0f7ceafdaa236f59ee8ae329b02b7ab4cf73f64bb9698aab7f25535d864924d5ac0327e795ab8
-
Filesize
97KB
MD5dad2bbd2cefefb690e9d458b9e95cb20
SHA1f611753682de0e4c73524e437539aa31a7c3333d
SHA25603a2e445ed441b80dcd66d40aac8589357dbc65636ffe3dae1847275cce58ffd
SHA51246b0c6117e8a206b87ab18f4b9d19a932b0d4ba9521fabe50431c5541ac6399b63bf32db455f0b00ec786b3df41dd61525f9955f37b4a8a83bc06ddd9f8d654a