Analysis
- max time kernel
37s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 08:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe
- Size 1.8MB
- Sample260712-j2xdkaev3n
- SHA256 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257
- MD5 914069c97395ceb28d1acbff9ba7bb98
- SHA1 7e556c5c2fde76748212b832405cdbe3c57fcca0
- SHA512 c3c11fb2d0ac39d1acf28b73bed076ed4b6420aecd917708794baa03e412752c299345bba47370b3e8617c8f0f7f5400f66109218527826c50af993dbf78403b
- SSDEEP 24576:bpmYiBJ6zomtkwEhCBRLmJ3p0oNtzoZ5YYGG4bRbiWCqUW4qBGsRNLemzG+5LhoH:bzinmGfCu3ptv8GfbRb02DxbB51cCoZ
- TLSH T1A785120102C245FFD7329F716D463252860EAC8EFC6AADA6DD13F6A118FE92544FE50E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Un.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Un.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Un.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Un.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Un.exe - Executes dropped EXE 1 IoCs
pid Process 4128 Un.exe - Loads dropped DLL 5 IoCs
pid Process 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Un.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Un.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: Un.exe File opened (read-only) \??\G: Un.exe File opened (read-only) \??\H: Un.exe File opened (read-only) \??\I: Un.exe -
resource yara_rule behavioral2/memory/3788-2-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-5-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-6-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-11-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-10-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-24-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-12-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-8-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-9-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-7-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/3788-4-0x00000000025D0000-0x000000000368A000-memory.dmp upx behavioral2/memory/4128-45-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-44-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-51-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-52-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-53-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-54-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-55-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-61-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-62-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-63-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-58-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-76-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-77-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-78-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-81-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-80-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-79-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-84-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-83-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-88-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-93-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-94-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-97-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-99-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-105-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-106-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-107-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-108-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-109-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-111-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-112-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-115-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-116-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-119-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-118-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-122-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-126-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-127-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-134-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-136-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-141-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx behavioral2/memory/4128-142-0x000000000CCF0000-0x000000000DDAA000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e595ae8 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe File opened for modification C:\Windows\SYSTEM.INI 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe File created C:\Windows\e599021 Un.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Un.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe 4128 Un.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Token: SeDebugPrivilege 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3788 wrote to memory of 1180 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 15 PID 3788 wrote to memory of 3076 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 45 PID 3788 wrote to memory of 3196 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 47 PID 3788 wrote to memory of 3452 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 49 PID 3788 wrote to memory of 3316 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 57 PID 3788 wrote to memory of 4380 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 59 PID 3788 wrote to memory of 4440 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 60 PID 3788 wrote to memory of 4472 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 61 PID 3788 wrote to memory of 4736 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 63 PID 3788 wrote to memory of 2968 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 64 PID 3788 wrote to memory of 5296 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 65 PID 3788 wrote to memory of 5364 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 66 PID 3788 wrote to memory of 5400 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 67 PID 3788 wrote to memory of 468 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 80 PID 3788 wrote to memory of 1708 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 81 PID 3788 wrote to memory of 3692 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 82 PID 3788 wrote to memory of 4932 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 83 PID 3788 wrote to memory of 4128 3788 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe 87 PID 4128 wrote to memory of 1180 4128 Un.exe 15 PID 4128 wrote to memory of 3076 4128 Un.exe 45 PID 4128 wrote to memory of 3196 4128 Un.exe 47 PID 4128 wrote to memory of 3452 4128 Un.exe 49 PID 4128 wrote to memory of 3316 4128 Un.exe 57 PID 4128 wrote to memory of 4380 4128 Un.exe 59 PID 4128 wrote to memory of 4440 4128 Un.exe 60 PID 4128 wrote to memory of 4472 4128 Un.exe 61 PID 4128 wrote to memory of 4736 4128 Un.exe 63 PID 4128 wrote to memory of 2968 4128 Un.exe 64 PID 4128 wrote to memory of 5296 4128 Un.exe 65 PID 4128 wrote to memory of 5364 4128 Un.exe 66 PID 4128 wrote to memory of 5400 4128 Un.exe 67 PID 4128 wrote to memory of 468 4128 Un.exe 80 PID 4128 wrote to memory of 1708 4128 Un.exe 81 PID 4128 wrote to memory of 3692 4128 Un.exe 82 PID 4128 wrote to memory of 4932 4128 Un.exe 83 PID 4128 wrote to memory of 1180 4128 Un.exe 15 PID 4128 wrote to memory of 3076 4128 Un.exe 45 PID 4128 wrote to memory of 3196 4128 Un.exe 47 PID 4128 wrote to memory of 3452 4128 Un.exe 49 PID 4128 wrote to memory of 3316 4128 Un.exe 57 PID 4128 wrote to memory of 4380 4128 Un.exe 59 PID 4128 wrote to memory of 4440 4128 Un.exe 60 PID 4128 wrote to memory of 4472 4128 Un.exe 61 PID 4128 wrote to memory of 4736 4128 Un.exe 63 PID 4128 wrote to memory of 2968 4128 Un.exe 64 PID 4128 wrote to memory of 5296 4128 Un.exe 65 PID 4128 wrote to memory of 5364 4128 Un.exe 66 PID 4128 wrote to memory of 5400 4128 Un.exe 67 PID 4128 wrote to memory of 468 4128 Un.exe 80 PID 4128 wrote to memory of 1708 4128 Un.exe 81 PID 4128 wrote to memory of 3692 4128 Un.exe 82 PID 4128 wrote to memory of 4932 4128 Un.exe 83 PID 4128 wrote to memory of 1180 4128 Un.exe 15 PID 4128 wrote to memory of 3076 4128 Un.exe 45 PID 4128 wrote to memory of 3196 4128 Un.exe 47 PID 4128 wrote to memory of 3452 4128 Un.exe 49 PID 4128 wrote to memory of 3316 4128 Un.exe 57 PID 4128 wrote to memory of 4380 4128 Un.exe 59 PID 4128 wrote to memory of 4440 4128 Un.exe 60 PID 4128 wrote to memory of 4472 4128 Un.exe 61 PID 4128 wrote to memory of 4736 4128 Un.exe 63 PID 4128 wrote to memory of 2968 4128 Un.exe 64 PID 4128 wrote to memory of 5296 4128 Un.exe 65 PID 4128 wrote to memory of 5364 4128 Un.exe 66 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Un.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3196
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3316
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4380
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4440
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4472
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4736
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:2968
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5296
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5364
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5400
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:468
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe"C:\Users\Admin\AppData\Local\Temp\16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe"C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4128
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:3692
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4932
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ipqrqw.exe
- Size 1KB
- SHA256 03e0c6c4ca8a24f961477887763397045e67862e059f7494014aefc21891d40e
- MD5 b360fa63134a63f9acfe046d2dfe10d9
- SHA1 b47a7f2ad61c79e454b55e39b0d7500aca753a17
- SHA512 575673255d389fc6667f46931301925bf4bb3030d7a3f6da3d3e7d878f86bb496ad6706e20191a1daa2e177cacda9b677424327bd9d438c1ad109c4222064102
- TLSH T12A11AB4317A9ACBBD2CC227E06C3D006A8BD1C0507F7C8B31F901479A42236A3AF5E15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6076.tmp\FindProcDLL.dll
- Size 492KB
- SHA256 bda8e0ddb672ea3558ad68634c49da06cd72f93d7fca642ca41df00e26512df1
- MD5 633625aa3be670a515fa87ff3a566d90
- SHA1 de035c083125aef5df0a55c153ef6cc4dd4c15b4
- SHA512 3c687ddf0e4e93a6787a23a93e2011df42898f6d21101c848a1b7c7bd2eddd5d49fdd0748e47e6235e7808596d00a1ecf79b5c975d050dd8d00a95f515a444a9
- SSDEEP 12288:LAeafIS4J8anXexYWGRhvgbTu4RJ6//sCMUx:04J9/WGRS33+
- TLSH T156B44B00B660C01DF4FA00F9D2BAA95DAA1979B0573C94CBA1E5F6CE07395E5AD33393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6076.tmp\System.dll
- Size 12KB
- SHA256 1d0ff7a0b131aca891833a39eb5771f77ff595d91f00102071661b8d00888555
- MD5 a08c2581acfe27b4f8797c34b0043bb7
- SHA1 370ab892cc8805e53e82a69c197b97499b49c0d1
- SHA512 e4ea98f5c282c2051e5138063416f14bc3f1449c6bf5eebd2486d0c1190a1fbc20a87651bb96b8e98df7697a49043695d1d6f7a59953ccccb00326bd2eb70976
- SSDEEP 192:ycT+SdpWQVDZ0VeqeUCFRJYTkvBo9LnNWNkRHE1MMSm:f+85GVesCFR8kJo1nE0E1Nl
- TLSH T1BD423943BF614AF2E9554736046A7F1B4B3CEE5503D4469BCFD39444A8B10E324396E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6076.tmp\WeChatInstallDll.dll
- Size 3.4MB
- SHA256 fdae19ace7a6f411b08effef7cb2c482bc6489964a15e276281f8e40b2d75fd4
- MD5 d66d83c3b3051211b5b9e7854e22f0ce
- SHA1 1acc2d9abb621aabc6127c6b76a65f835e207139
- SHA512 2740a058708bf9a81c7561a9e0dee423e69501e5358515c85c3aaa0bf3e26e82a8c087689515ebd3e174f120f046b93816c14f87476e231099721cc53b343c7f
- SSDEEP 98304:aW/+542YdKDelbPqx55PPwiLR5md9LyNY:aWG54awi5qd9+N
- TLSH T1F2F5C002FB82D272E59A0274617767BB4DBD6E30A73588C3D7E03D7588305E2663A35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
- Size 1.8MB
- SHA256 16776e0485463a74be62e33fbb72e72951bb6e48569d150667f7f0f54cecc257
- MD5 914069c97395ceb28d1acbff9ba7bb98
- SHA1 7e556c5c2fde76748212b832405cdbe3c57fcca0
- SHA512 c3c11fb2d0ac39d1acf28b73bed076ed4b6420aecd917708794baa03e412752c299345bba47370b3e8617c8f0f7f5400f66109218527826c50af993dbf78403b
- SSDEEP 24576:bpmYiBJ6zomtkwEhCBRLmJ3p0oNtzoZ5YYGG4bRbiWCqUW4qBGsRNLemzG+5LhoH:bzinmGfCu3ptv8GfbRb02DxbB51cCoZ
- TLSH T1A785120102C245FFD7329F716D463252860EAC8EFC6AADA6DD13F6A118FE92544FE50E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 605cc8dc45c206a59d561f0444c644154c4e2c78b88126e9b6c610f326ac8073
- MD5 bf5bcd799d8b72c4fed4fe60902aafab
- SHA1 d4a58a185e0aa3747bb1998271240885184fe540
- SHA512 f561244768f00b2147437966867a26c5de6be5d7ab7c87741a386698d0d38b755a8659421ae1889ba35ba33db62c959ea165ac777e88f21650b6c7c01052c8e9
- TLSH T1F8D0170E4B9911A9A096002E2178D4C672299E1198320B4C503967816428BA9BF7E2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\wrqmje.exe
- Size 97KB
- SHA256 649e97ad3a1000a72e4e0c7d8b7618b2de2bb5ac60a4b77d7ac6345d6d9352db
- MD5 8d5dc83ff16c454d6bc7a64d58856783
- SHA1 53ad494b531e89a638aca2e2325b9f6ba0e65ce4
- SHA512 6b8e08ecf99720c029aa46b2b52c9c8aee7d48f61d135b98c8073a12024e966b9b56ded8800ae38f7329af6e888cdd423357e1cb9cdbdbb70a9f929c35b2dd44
- SSDEEP 1536:1Uab1rJXVK/TSGHcvX89tgo2omYpiKIORS:1x1rJlK/VM89ytYp9IO
- TLSH T145A3027942862295C8E4BA3EE2DB1103F7948264327D67B75FE348FA0D0E91B0715EDB
- MD5 SHA1 SHA512 SSDEEP TLSH