Analysis
-
max time kernel
42s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 19:38
Static task
static1
Behavioral task
behavioral1
Sample
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe
Resource
win7-20240611-en
General
-
Target
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe
-
Size
740KB
-
MD5
0ad338265d75150f736ddc5c1ae69125
-
SHA1
20953aa36c97212e7737803b9ff7f1d30de60069
-
SHA256
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba
-
SHA512
d1b3cbfea56cd0b5d1420194d021d7af56df8069f15167efa5b69058ac1dd94d4cae78aa5046bd4fed7c6957624e3099a1c9a9f6575daa6a64e0a19e5aed50fc
-
SSDEEP
12288:8TyjXW+48qWywrU4kGFezOAVuJ5PIoww7F5DO3HYff1Tq/Scj:KIXW/8yw1ez54lI+F5SXYHhq/Dj
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Processes:
rundll32.exe24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe -
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 43 IoCs
Processes:
resource yara_rule behavioral2/memory/3504-3-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-6-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-7-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-17-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-14-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-5-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-8-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-4-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-1-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-18-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-23-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-20-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3504-30-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-44-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-47-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-53-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-60-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-72-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-75-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-89-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-90-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine C:\dvgl.pif INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-123-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1816-141-0x0000000004EE0000-0x0000000005F6E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 44 IoCs
Processes:
resource yara_rule behavioral2/memory/3504-3-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-6-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-7-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-17-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-14-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-5-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-8-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-4-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-1-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-18-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-23-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-20-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-30-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/3504-40-0x0000000000400000-0x00000000004C1000-memory.dmp UPX behavioral2/memory/1816-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-44-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-47-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-53-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-60-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-72-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-75-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-89-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-90-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-123-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX behavioral2/memory/1816-140-0x0000000000400000-0x00000000004C1000-memory.dmp UPX behavioral2/memory/1816-141-0x0000000004EE0000-0x0000000005F6E000-memory.dmp UPX -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 1816 rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 1816 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/3504-3-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-6-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-7-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-17-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-14-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-5-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-8-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-4-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-1-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-18-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-23-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-20-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/3504-30-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/1816-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-44-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-47-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-53-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-60-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-72-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-75-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-89-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-90-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-123-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx behavioral2/memory/1816-141-0x0000000004EE0000-0x0000000005F6E000-memory.dmp upx -
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe -
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe -
Drops file in Program Files directory 4 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe rundll32.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe rundll32.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe rundll32.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exepid process 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exedescription pid process Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Token: SeDebugPrivilege 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exepid process 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe 1816 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exedescription pid process target process PID 3504 wrote to memory of 792 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe fontdrvhost.exe PID 3504 wrote to memory of 800 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe fontdrvhost.exe PID 3504 wrote to memory of 336 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe dwm.exe PID 3504 wrote to memory of 3048 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe sihost.exe PID 3504 wrote to memory of 508 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe svchost.exe PID 3504 wrote to memory of 772 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe taskhostw.exe PID 3504 wrote to memory of 3392 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Explorer.EXE PID 3504 wrote to memory of 3516 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe svchost.exe PID 3504 wrote to memory of 3724 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe DllHost.exe PID 3504 wrote to memory of 3848 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe StartMenuExperienceHost.exe PID 3504 wrote to memory of 3940 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe RuntimeBroker.exe PID 3504 wrote to memory of 4020 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe SearchApp.exe PID 3504 wrote to memory of 3916 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe RuntimeBroker.exe PID 3504 wrote to memory of 2156 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe RuntimeBroker.exe PID 3504 wrote to memory of 2136 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe TextInputHost.exe PID 3504 wrote to memory of 2680 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe backgroundTaskHost.exe PID 3504 wrote to memory of 428 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe backgroundTaskHost.exe PID 3504 wrote to memory of 1816 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe rundll32.exe PID 3504 wrote to memory of 1816 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe rundll32.exe PID 3504 wrote to memory of 1816 3504 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe rundll32.exe PID 1816 wrote to memory of 792 1816 rundll32.exe fontdrvhost.exe PID 1816 wrote to memory of 800 1816 rundll32.exe fontdrvhost.exe PID 1816 wrote to memory of 336 1816 rundll32.exe dwm.exe PID 1816 wrote to memory of 3048 1816 rundll32.exe sihost.exe PID 1816 wrote to memory of 508 1816 rundll32.exe svchost.exe PID 1816 wrote to memory of 772 1816 rundll32.exe taskhostw.exe PID 1816 wrote to memory of 3392 1816 rundll32.exe Explorer.EXE PID 1816 wrote to memory of 3516 1816 rundll32.exe svchost.exe PID 1816 wrote to memory of 3724 1816 rundll32.exe DllHost.exe PID 1816 wrote to memory of 3848 1816 rundll32.exe StartMenuExperienceHost.exe PID 1816 wrote to memory of 3940 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 4020 1816 rundll32.exe SearchApp.exe PID 1816 wrote to memory of 3916 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 2156 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 2136 1816 rundll32.exe TextInputHost.exe PID 1816 wrote to memory of 428 1816 rundll32.exe backgroundTaskHost.exe PID 1816 wrote to memory of 4492 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 2812 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 792 1816 rundll32.exe fontdrvhost.exe PID 1816 wrote to memory of 800 1816 rundll32.exe fontdrvhost.exe PID 1816 wrote to memory of 336 1816 rundll32.exe dwm.exe PID 1816 wrote to memory of 3048 1816 rundll32.exe sihost.exe PID 1816 wrote to memory of 508 1816 rundll32.exe svchost.exe PID 1816 wrote to memory of 772 1816 rundll32.exe taskhostw.exe PID 1816 wrote to memory of 3392 1816 rundll32.exe Explorer.EXE PID 1816 wrote to memory of 3516 1816 rundll32.exe svchost.exe PID 1816 wrote to memory of 3724 1816 rundll32.exe DllHost.exe PID 1816 wrote to memory of 3848 1816 rundll32.exe StartMenuExperienceHost.exe PID 1816 wrote to memory of 3940 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 4020 1816 rundll32.exe SearchApp.exe PID 1816 wrote to memory of 3916 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 2156 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 2136 1816 rundll32.exe TextInputHost.exe PID 1816 wrote to memory of 428 1816 rundll32.exe backgroundTaskHost.exe PID 1816 wrote to memory of 4492 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 2812 1816 rundll32.exe RuntimeBroker.exe PID 1816 wrote to memory of 792 1816 rundll32.exe fontdrvhost.exe PID 1816 wrote to memory of 800 1816 rundll32.exe fontdrvhost.exe PID 1816 wrote to memory of 336 1816 rundll32.exe dwm.exe PID 1816 wrote to memory of 3048 1816 rundll32.exe sihost.exe PID 1816 wrote to memory of 508 1816 rundll32.exe svchost.exe PID 1816 wrote to memory of 772 1816 rundll32.exe taskhostw.exe PID 1816 wrote to memory of 3392 1816 rundll32.exe Explorer.EXE PID 1816 wrote to memory of 3516 1816 rundll32.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe"C:\Users\Admin\AppData\Local\Temp\24ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
8Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Hide Artifacts
2Hidden Files and Directories
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0E577724_Rar\rundll32.exeFilesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeFilesize
740KB
MD50ad338265d75150f736ddc5c1ae69125
SHA120953aa36c97212e7737803b9ff7f1d30de60069
SHA25624ca33ca428b2292ab7cc0d4c2950a76ab79e455d66ea7506ecdc300a68074ba
SHA512d1b3cbfea56cd0b5d1420194d021d7af56df8069f15167efa5b69058ac1dd94d4cae78aa5046bd4fed7c6957624e3099a1c9a9f6575daa6a64e0a19e5aed50fc
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5dd68e2c10994ee63a7f9e09c9b12bcc4
SHA1d39b3a8ed0bad962ab457e70edb633a5befaf316
SHA256f212824563c2a0a3333a7ed134315a65c8d93005365094648d4f37e7fb38ed26
SHA5127c577f4a4ecef1dc8cad36e53c03c3bc341dffc2774285e1f464770555ea19893d01eb56760d727f02b209a159861cfc9a609397f85e3cd040a9075b335a8dfb
-
C:\dvgl.pifFilesize
100KB
MD5e10a9b3acf4c2e50235eff9176ab4e64
SHA12e34100fb74865aaf9e8c2254b8554b14bfcfc37
SHA256f39e6ded25a4f4bf40db8294eacdcd4c160abc06fe9999c9bf74824086a24bf2
SHA51282d28cfe676179f8ea586b3bef7c5002362000f6bce1b7620c7d76d6f955797201d839596510519fcd072bfed489cd9ce7ad5af94effcd3f89f1914cdf570674
-
memory/1816-70-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-72-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-141-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-140-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1816-55-0x0000000008370000-0x0000000008371000-memory.dmpFilesize
4KB
-
memory/1816-123-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-44-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-89-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-83-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-81-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-78-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-76-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-75-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-71-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-69-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-67-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-65-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-64-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-48-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-50-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-51-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-57-0x00000000036B0000-0x00000000036B2000-memory.dmpFilesize
8KB
-
memory/1816-58-0x00000000036B0000-0x00000000036B2000-memory.dmpFilesize
8KB
-
memory/1816-52-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-46-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-49-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-56-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-124-0x00000000036B0000-0x00000000036B2000-memory.dmpFilesize
8KB
-
memory/1816-90-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-47-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-53-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-60-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-59-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/1816-63-0x0000000004EE0000-0x0000000005F6E000-memory.dmpFilesize
16.6MB
-
memory/3504-5-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-20-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-6-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-30-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-0-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/3504-11-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3504-18-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-17-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-40-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/3504-16-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3504-4-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-1-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-8-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-9-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3504-3-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-10-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/3504-23-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-14-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/3504-7-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB