sality | 064594771fd6de5d606d49b66f68066fbe33659fce1fce7e04e5591f8f50ed32

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

064594771fd6de5d606d49b66f68066fbe33659fce1fce7e04e5591f8f50ed32.dll
Size

120KB
MD5

4681e5f309b44761f9e39c57a1168ab7
SHA1

4fbb7aea9887698d189424525f7109184fb7bd34
SHA256

064594771fd6de5d606d49b66f68066fbe33659fce1fce7e04e5591f8f50ed32
SHA512

a4f3b216706b29d587bd496f9cb026853fd4a85f9e584c69cf6fc8aa3671d68354ea8c82c820e0b85541db9a5ef071973dd6bd19f1daaadbc2d2b17bc15bba13
SSDEEP

3072:hHLI9KerBaHVg3/kfWPmdEhfaLaqIL389xjosGM:BLMruVg3vPPhfnhQ9xjo

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e575c1a.exee573c8c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e573c8c.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e573c8c.exee575c1a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575c1a.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e573c8c.exee575c1a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e573c8c.exe

Executes dropped EXE 3 IoCs

Processes:

e573c8c.exee573de4.exee575c1a.exe

pid process

388 e573c8c.exe
1696 e573de4.exe
4680 e575c1a.exe

pid	process
388	e573c8c.exe
1696	e573de4.exe
4680	e575c1a.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/388-8-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-11-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-10-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-9-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-6-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-12-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-23-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-34-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-29-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-13-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-28-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-37-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-36-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-38-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-39-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-40-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-42-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-51-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-53-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-62-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-63-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-64-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-67-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-69-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-72-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-73-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-77-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-79-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-78-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/388-81-0x0000000000750000-0x000000000180A000-memory.dmp	upx
behavioral2/memory/4680-127-0x0000000000B40000-0x0000000001BFA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e573c8c.exee575c1a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e573c8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575c1a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575c1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575c1a.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e573c8c.exee575c1a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575c1a.exe

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e573c8c.exe

description	ioc	process
File opened (read-only)	\??\I:	e573c8c.exe
File opened (read-only)	\??\K:	e573c8c.exe
File opened (read-only)	\??\L:	e573c8c.exe
File opened (read-only)	\??\M:	e573c8c.exe
File opened (read-only)	\??\Q:	e573c8c.exe
File opened (read-only)	\??\E:	e573c8c.exe
File opened (read-only)	\??\G:	e573c8c.exe
File opened (read-only)	\??\H:	e573c8c.exe
File opened (read-only)	\??\P:	e573c8c.exe
File opened (read-only)	\??\J:	e573c8c.exe
File opened (read-only)	\??\N:	e573c8c.exe
File opened (read-only)	\??\O:	e573c8c.exe

Drops file in Program Files directory 4 IoCs

Processes:

e573c8c.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e573c8c.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e573c8c.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	e573c8c.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e573c8c.exe

Drops file in Windows directory 3 IoCs

Processes:

e573c8c.exee575c1a.exe

description ioc process

File created C:\Windows\e573cbb e573c8c.exe
File opened for modification C:\Windows\SYSTEM.INI e573c8c.exe
File created C:\Windows\e57aa88 e575c1a.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e573c8c.exe

pid process

388 e573c8c.exe
388 e573c8c.exe
388 e573c8c.exe
388 e573c8c.exe

description	ioc	process
File created	C:\Windows\e573cbb	e573c8c.exe
File opened for modification	C:\Windows\SYSTEM.INI	e573c8c.exe
File created	C:\Windows\e57aa88	e575c1a.exe

pid	process
388	e573c8c.exe
388	e573c8c.exe
388	e573c8c.exe
388	e573c8c.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e573c8c.exe

description	pid	process
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe
Token: SeDebugPrivilege	388	e573c8c.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

rundll32.exerundll32.exee573c8c.exe

description	pid	process	target process
PID 4212 wrote to memory of 2844	4212	rundll32.exe	rundll32.exe
PID 4212 wrote to memory of 2844	4212	rundll32.exe	rundll32.exe
PID 4212 wrote to memory of 2844	4212	rundll32.exe	rundll32.exe
PID 2844 wrote to memory of 388	2844	rundll32.exe	e573c8c.exe
PID 2844 wrote to memory of 388	2844	rundll32.exe	e573c8c.exe
PID 2844 wrote to memory of 388	2844	rundll32.exe	e573c8c.exe
PID 388 wrote to memory of 784	388	e573c8c.exe	fontdrvhost.exe
PID 388 wrote to memory of 788	388	e573c8c.exe	fontdrvhost.exe
PID 388 wrote to memory of 60	388	e573c8c.exe	dwm.exe
PID 388 wrote to memory of 2552	388	e573c8c.exe	sihost.exe
PID 388 wrote to memory of 2624	388	e573c8c.exe	svchost.exe
PID 388 wrote to memory of 3008	388	e573c8c.exe	taskhostw.exe
PID 388 wrote to memory of 3436	388	e573c8c.exe	Explorer.EXE
PID 388 wrote to memory of 3576	388	e573c8c.exe	svchost.exe
PID 388 wrote to memory of 3760	388	e573c8c.exe	DllHost.exe
PID 388 wrote to memory of 3852	388	e573c8c.exe	StartMenuExperienceHost.exe
PID 388 wrote to memory of 3948	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 4032	388	e573c8c.exe	SearchApp.exe
PID 388 wrote to memory of 4124	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 3140	388	e573c8c.exe	TextInputHost.exe
PID 388 wrote to memory of 4696	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 4928	388	e573c8c.exe	backgroundTaskHost.exe
PID 388 wrote to memory of 3888	388	e573c8c.exe	backgroundTaskHost.exe
PID 388 wrote to memory of 4212	388	e573c8c.exe	rundll32.exe
PID 388 wrote to memory of 2844	388	e573c8c.exe	rundll32.exe
PID 388 wrote to memory of 2844	388	e573c8c.exe	rundll32.exe
PID 2844 wrote to memory of 1696	2844	rundll32.exe	e573de4.exe
PID 2844 wrote to memory of 1696	2844	rundll32.exe	e573de4.exe
PID 2844 wrote to memory of 1696	2844	rundll32.exe	e573de4.exe
PID 2844 wrote to memory of 4680	2844	rundll32.exe	e575c1a.exe
PID 2844 wrote to memory of 4680	2844	rundll32.exe	e575c1a.exe
PID 2844 wrote to memory of 4680	2844	rundll32.exe	e575c1a.exe
PID 388 wrote to memory of 784	388	e573c8c.exe	fontdrvhost.exe
PID 388 wrote to memory of 788	388	e573c8c.exe	fontdrvhost.exe
PID 388 wrote to memory of 60	388	e573c8c.exe	dwm.exe
PID 388 wrote to memory of 2552	388	e573c8c.exe	sihost.exe
PID 388 wrote to memory of 2624	388	e573c8c.exe	svchost.exe
PID 388 wrote to memory of 3008	388	e573c8c.exe	taskhostw.exe
PID 388 wrote to memory of 3436	388	e573c8c.exe	Explorer.EXE
PID 388 wrote to memory of 3576	388	e573c8c.exe	svchost.exe
PID 388 wrote to memory of 3760	388	e573c8c.exe	DllHost.exe
PID 388 wrote to memory of 3852	388	e573c8c.exe	StartMenuExperienceHost.exe
PID 388 wrote to memory of 3948	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 4032	388	e573c8c.exe	SearchApp.exe
PID 388 wrote to memory of 4124	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 3140	388	e573c8c.exe	TextInputHost.exe
PID 388 wrote to memory of 4696	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 4928	388	e573c8c.exe	backgroundTaskHost.exe
PID 388 wrote to memory of 3888	388	e573c8c.exe	backgroundTaskHost.exe
PID 388 wrote to memory of 1696	388	e573c8c.exe	e573de4.exe
PID 388 wrote to memory of 1696	388	e573c8c.exe	e573de4.exe
PID 388 wrote to memory of 1788	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 5000	388	e573c8c.exe	RuntimeBroker.exe
PID 388 wrote to memory of 4680	388	e573c8c.exe	e575c1a.exe
PID 388 wrote to memory of 4680	388	e573c8c.exe	e575c1a.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e573c8c.exee575c1a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573c8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575c1a.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:60

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2624

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3008

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\064594771fd6de5d606d49b66f68066fbe33659fce1fce7e04e5591f8f50ed32.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\064594771fd6de5d606d49b66f68066fbe33659fce1fce7e04e5591f8f50ed32.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Local\Temp\e573c8c.exe
C:\Users\Admin\AppData\Local\Temp\e573c8c.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:388

C:\Users\Admin\AppData\Local\Temp\e573de4.exe
C:\Users\Admin\AppData\Local\Temp\e573de4.exe
4⤵
- Executes dropped EXE
PID:1696

C:\Users\Admin\AppData\Local\Temp\e575c1a.exe
C:\Users\Admin\AppData\Local\Temp\e575c1a.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3576

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3760

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4032

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4124

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3140

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4696

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4928

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3888

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1788

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5000

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e573c8c.exe
Filesize
97KB

MD5
f5f6a55c00b3aec25834f85933fb04da

SHA1
7187cf6b5f85433695bbf6b45fb20e119ff90fee

SHA256
0dccd6f16614713dc8eed76b24d67a576f663c3dc37ccba3c3534de98deae16c

SHA512
2b5b32aba92f13747e34e446f505b80e92ba0917671a627731b690601dbb0ca27c6a450140e65b4c20e3456d7ddf1888850f071d441785d290576f9978e98ad2

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
9c3550ec98c3d53145be3f5899745743

SHA1
36a584ff2a05a45dd811b76ba57e194976aaba04

SHA256
a012660a994cfa915874d04903ada3339a4be682cd5009f56c8aef188c67dc4f

SHA512
3c0856dd864dc981ed081b342c72910ed8edfb8666c318cf31f74a6742bd7167ce477a08f0600529c2ce587b0ed8fd77f9242513de6641067555af7fca957847

Download Submit
memory/388-42-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-72-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-10-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-9-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-6-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-12-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-23-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-34-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-29-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-13-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-31-0x0000000001A30000-0x0000000001A32000-memory.dmp

Filesize
8KB

Download
memory/388-28-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-17-0x0000000001A40000-0x0000000001A41000-memory.dmp

Filesize
4KB

Download
memory/388-24-0x0000000001A30000-0x0000000001A32000-memory.dmp

Filesize
8KB

Download
memory/388-51-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/388-53-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-81-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-88-0x0000000001A30000-0x0000000001A32000-memory.dmp

Filesize
8KB

Download
memory/388-37-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-36-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-38-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-39-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-40-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-78-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-79-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-8-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-77-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-98-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/388-73-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-11-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-69-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-67-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-64-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-63-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/388-62-0x0000000000750000-0x000000000180A000-memory.dmp

Filesize
16.7MB

Download
memory/1696-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1696-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1696-102-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1696-56-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2844-25-0x0000000000980000-0x0000000000982000-memory.dmp

Filesize
8KB

Download
memory/2844-15-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/2844-30-0x0000000000980000-0x0000000000982000-memory.dmp

Filesize
8KB

Download
memory/2844-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2844-14-0x0000000000980000-0x0000000000982000-memory.dmp

Filesize
8KB

Download
memory/4680-58-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4680-126-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4680-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4680-128-0x0000000000B40000-0x0000000001BFA000-memory.dmp

Filesize
16.7MB

Download
memory/4680-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4680-61-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4680-127-0x0000000000B40000-0x0000000001BFA000-memory.dmp

Filesize
16.7MB

Download