Analysis
-
max time kernel
104s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2025, 01:30
Static task
static1
1 signatures
General
-
Target
202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe
-
Size
4.8MB
-
MD5
66a079c9039569f42e0c80d8c1717385
-
SHA1
2f48327e0295b7f204a9a845b0b01692b13d9381
-
SHA256
202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406
-
SHA512
4fcc1fe058bb3415b3afe7e060c267673c085bdb6b56933ab83fbc6336e3dc2df37cd1d672af95e9a685730aad5007c2242411d38b81ef0cc976a095306f59bf
-
SSDEEP
98304:RrXf368BJxAjBCGhcUISE09MkD1d49dvj3A5pRW/4Tj/eKKHCUKA:RT33rAjgGhcUI/GBm3u3KHCbA
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
resource yara_rule behavioral1/memory/4864-5-0x0000000002860000-0x000000000391A000-memory.dmp upx behavioral1/memory/4864-11-0x0000000002860000-0x000000000391A000-memory.dmp upx behavioral1/memory/4864-12-0x0000000002860000-0x000000000391A000-memory.dmp upx behavioral1/memory/4864-4-0x0000000002860000-0x000000000391A000-memory.dmp upx behavioral1/memory/4864-3-0x0000000002860000-0x000000000391A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e57630f 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe File opened for modification C:\Windows\SYSTEM.INI 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe Token: SeDebugPrivilege 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4864 wrote to memory of 764 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 8 PID 4864 wrote to memory of 772 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 9 PID 4864 wrote to memory of 384 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 13 PID 4864 wrote to memory of 2968 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 49 PID 4864 wrote to memory of 2984 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 50 PID 4864 wrote to memory of 2704 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 53 PID 4864 wrote to memory of 3476 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 56 PID 4864 wrote to memory of 3588 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 57 PID 4864 wrote to memory of 3788 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 58 PID 4864 wrote to memory of 3880 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 59 PID 4864 wrote to memory of 3968 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 60 PID 4864 wrote to memory of 4056 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 61 PID 4864 wrote to memory of 4228 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 62 PID 4864 wrote to memory of 5432 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 65 PID 4864 wrote to memory of 4160 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 77 PID 4864 wrote to memory of 5428 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 83 PID 4864 wrote to memory of 3060 4864 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe 84 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2984
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2704
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe"C:\Users\Admin\AppData\Local\Temp\202da0dc9521121264001265ceb918743dccd7a4e48d5ba7083a200c73d58406.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3788
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3880
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3968
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4056
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4228
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5432
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4160
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5428
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5