Analysis
- max time kernel
148s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe
- Size 797KB
- Sample260417-k4vs7ac18x
- SHA256 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12
- MD5 2f326140f8dcb88810ee9d4a45d3597b
- SHA1 da7eb2565f88dcab7162e33e10e4b923c6097f16
- SHA512 7ec13d55afc063d170968e1fc334ac99d48f33e6af3824ec556573abebac01ef3514bf17640d25bb04b023ca21c0c8d5ffd9504f2dd24c206495813e60cb23e6
- SSDEEP 12288:ELCdICnX25awdA0gvSV2xNj/3jb9mg/jxIWRV/Tucqlcjqous:LNnXgawdUSV27zbsAjxxucqlcLT
- TLSH T10B05BF213DE1C076D2733170485DC35866BAF4324A3A4E97B7CC67AD2F246C29B25BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - Windows security modification 2 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe -
resource yara_rule behavioral2/memory/5196-1-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/5196-6-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/5196-7-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/5196-11-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/5196-5-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/5196-9-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/5196-4-0x0000000002590000-0x000000000364A000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe File created C:\Windows\e57e177 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe Token: SeDebugPrivilege 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5196 wrote to memory of 808 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe 8 PID 5196 wrote to memory of 816 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe 9 PID 5196 wrote to memory of 896 5196 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe 15 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:816
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe"C:\Users\Admin\AppData\Local\Temp\93043332af4a2804edcccf1744a04c06c23a66d11d728cf09121791a43b27d12.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5196
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5