Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe
- Size 802KB
- Sample260426-fttqxset3x
- SHA256 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02
- MD5 d1e1aa9712e8d4352fe7f4c1b9b01378
- SHA1 98ff8712a6c05e64245250d16ed21c3b41a98f61
- SHA512 6f27a98b81bf5d54a4b1a9d0688d189fde7d8938ee89a7a3e3c94e1a8b15f2c5b0971235738e532e20c7b61fff8ae852a0061737e31cf4e759ae8b6ace09e0be
- SSDEEP 12288:EmpAmGerIVqXyb6Zy4AhSJgmy/RTJoO3KvqehG0ogZaFMfwMkb5:EmxGC4qXyJ7SJgV/9uO+hdogZmA9g5
- TLSH T19705BF2279E1C072D1337171095CC758A2BAF4724A3A4EAB77CC676E2F345C18B35BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
-
http://klkjwre77638dfqwieuoi888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - Disables Task Manager via registry modification
- Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe -
resource yara_rule behavioral1/memory/1032-1-0x0000000003040000-0x00000000040CE000-memory.dmp upx behavioral1/memory/1032-3-0x0000000003040000-0x00000000040CE000-memory.dmp upx behavioral1/memory/1032-4-0x0000000003040000-0x00000000040CE000-memory.dmp upx behavioral1/memory/1032-6-0x0000000003040000-0x00000000040CE000-memory.dmp upx behavioral1/memory/1032-8-0x0000000003040000-0x00000000040CE000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe Token: SeDebugPrivilege 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1032 wrote to memory of 816 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe 9 PID 1032 wrote to memory of 824 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe 10 PID 1032 wrote to memory of 540 1032 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe 14 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:816
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:824
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe"C:\Users\Admin\AppData\Local\Temp\2188bc8da39e764599ed7b400b6a7bd27c7ae3344333584b7698bc2dc4b73f02.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1032
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5