sality | 1c12627263858757c96a5c4457e80aefbf2b31679194d68f36dac0f0e3adc38b

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c12627263858757c96a5c4457e80aefbf2b31679194d68f36dac0f0e3adc38b_NeikiAnalytics.dll
Size

120KB
MD5

4f3be58d7f0a03b190307abc47c31d30
SHA1

8a92ffc0b3c321cb0e2dea6767febfeb27b0561e
SHA256

1c12627263858757c96a5c4457e80aefbf2b31679194d68f36dac0f0e3adc38b
SHA512

74592b99801cf3816a3ebdbb3678236de10796257630776d065f6f8363c7cddcfe400f809b6c7a635269f3460766f677a7afafa90402c51d9395920efec31b8d
SSDEEP

3072:8mupdge5Trqfd0rbirf36jlFB1G7bZE17ltrESDK9r:gjufylpFHGRE1019

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 9 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e576d7f.exee576ed7.exee578973.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e578973.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e576d7f.exee576ed7.exee578973.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578973.exe

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e576d7f.exee578973.exee576ed7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578973.exe

Executes dropped EXE 3 IoCs

Processes:

e576d7f.exee576ed7.exee578973.exe

pid process

1012 e576d7f.exe
536 e576ed7.exe
2644 e578973.exe

pid	process
1012	e576d7f.exe
536	e576ed7.exe
2644	e578973.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1012-9-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-17-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-28-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-36-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-33-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-35-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-11-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-18-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-8-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-10-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-6-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-37-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-38-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-39-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-40-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-41-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-43-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-44-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-53-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-55-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-56-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-66-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-68-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-71-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-72-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-75-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-76-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-80-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-82-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-83-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/1012-86-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/536-128-0x0000000000B40000-0x0000000001BFA000-memory.dmp	upx
behavioral2/memory/2644-151-0x0000000000B30000-0x0000000001BEA000-memory.dmp	upx

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e576ed7.exee578973.exee576d7f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e576d7f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e576d7f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578973.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e578973.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e576d7f.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e576d7f.exee576ed7.exee578973.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578973.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e576d7f.exe

description	ioc	process
File opened (read-only)	\??\I:	e576d7f.exe
File opened (read-only)	\??\J:	e576d7f.exe
File opened (read-only)	\??\K:	e576d7f.exe
File opened (read-only)	\??\Q:	e576d7f.exe
File opened (read-only)	\??\S:	e576d7f.exe
File opened (read-only)	\??\E:	e576d7f.exe
File opened (read-only)	\??\O:	e576d7f.exe
File opened (read-only)	\??\P:	e576d7f.exe
File opened (read-only)	\??\L:	e576d7f.exe
File opened (read-only)	\??\N:	e576d7f.exe
File opened (read-only)	\??\G:	e576d7f.exe
File opened (read-only)	\??\H:	e576d7f.exe
File opened (read-only)	\??\M:	e576d7f.exe
File opened (read-only)	\??\R:	e576d7f.exe

Drops file in Program Files directory 4 IoCs

Processes:

e576d7f.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e576d7f.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e576d7f.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	e576d7f.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e576d7f.exe

Drops file in Windows directory 4 IoCs

Processes:

e576ed7.exee578973.exee576d7f.exe

description	ioc	process
File created	C:\Windows\e57be00	e576ed7.exe
File created	C:\Windows\e57d7f1	e578973.exe
File created	C:\Windows\e576ddd	e576d7f.exe
File opened for modification	C:\Windows\SYSTEM.INI	e576d7f.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e576d7f.exee576ed7.exe

pid process

1012 e576d7f.exe
1012 e576d7f.exe
1012 e576d7f.exe
1012 e576d7f.exe
536 e576ed7.exe
536 e576ed7.exe

pid	process
1012	e576d7f.exe
1012	e576d7f.exe
1012	e576d7f.exe
1012	e576d7f.exe
536	e576ed7.exe
536	e576ed7.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e576d7f.exe

description	pid	process
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe
Token: SeDebugPrivilege	1012	e576d7f.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

rundll32.exerundll32.exee576d7f.exee576ed7.exe

description	pid	process	target process
PID 3288 wrote to memory of 4276	3288	rundll32.exe	rundll32.exe
PID 3288 wrote to memory of 4276	3288	rundll32.exe	rundll32.exe
PID 3288 wrote to memory of 4276	3288	rundll32.exe	rundll32.exe
PID 4276 wrote to memory of 1012	4276	rundll32.exe	e576d7f.exe
PID 4276 wrote to memory of 1012	4276	rundll32.exe	e576d7f.exe
PID 4276 wrote to memory of 1012	4276	rundll32.exe	e576d7f.exe
PID 1012 wrote to memory of 776	1012	e576d7f.exe	fontdrvhost.exe
PID 1012 wrote to memory of 784	1012	e576d7f.exe	fontdrvhost.exe
PID 1012 wrote to memory of 1020	1012	e576d7f.exe	dwm.exe
PID 1012 wrote to memory of 2768	1012	e576d7f.exe	sihost.exe
PID 1012 wrote to memory of 2872	1012	e576d7f.exe	svchost.exe
PID 1012 wrote to memory of 1428	1012	e576d7f.exe	taskhostw.exe
PID 1012 wrote to memory of 3416	1012	e576d7f.exe	Explorer.EXE
PID 1012 wrote to memory of 3548	1012	e576d7f.exe	svchost.exe
PID 1012 wrote to memory of 3752	1012	e576d7f.exe	DllHost.exe
PID 1012 wrote to memory of 3860	1012	e576d7f.exe	StartMenuExperienceHost.exe
PID 1012 wrote to memory of 3924	1012	e576d7f.exe	RuntimeBroker.exe
PID 1012 wrote to memory of 4012	1012	e576d7f.exe	SearchApp.exe
PID 1012 wrote to memory of 3844	1012	e576d7f.exe	RuntimeBroker.exe
PID 1012 wrote to memory of 2308	1012	e576d7f.exe	RuntimeBroker.exe
PID 1012 wrote to memory of 548	1012	e576d7f.exe	TextInputHost.exe
PID 1012 wrote to memory of 3288	1012	e576d7f.exe	rundll32.exe
PID 1012 wrote to memory of 4276	1012	e576d7f.exe	rundll32.exe
PID 1012 wrote to memory of 4276	1012	e576d7f.exe	rundll32.exe
PID 4276 wrote to memory of 536	4276	rundll32.exe	e576ed7.exe
PID 4276 wrote to memory of 536	4276	rundll32.exe	e576ed7.exe
PID 4276 wrote to memory of 536	4276	rundll32.exe	e576ed7.exe
PID 4276 wrote to memory of 2644	4276	rundll32.exe	e578973.exe
PID 4276 wrote to memory of 2644	4276	rundll32.exe	e578973.exe
PID 4276 wrote to memory of 2644	4276	rundll32.exe	e578973.exe
PID 1012 wrote to memory of 776	1012	e576d7f.exe	fontdrvhost.exe
PID 1012 wrote to memory of 784	1012	e576d7f.exe	fontdrvhost.exe
PID 1012 wrote to memory of 1020	1012	e576d7f.exe	dwm.exe
PID 1012 wrote to memory of 2768	1012	e576d7f.exe	sihost.exe
PID 1012 wrote to memory of 2872	1012	e576d7f.exe	svchost.exe
PID 1012 wrote to memory of 1428	1012	e576d7f.exe	taskhostw.exe
PID 1012 wrote to memory of 3416	1012	e576d7f.exe	Explorer.EXE
PID 1012 wrote to memory of 3548	1012	e576d7f.exe	svchost.exe
PID 1012 wrote to memory of 3752	1012	e576d7f.exe	DllHost.exe
PID 1012 wrote to memory of 3860	1012	e576d7f.exe	StartMenuExperienceHost.exe
PID 1012 wrote to memory of 3924	1012	e576d7f.exe	RuntimeBroker.exe
PID 1012 wrote to memory of 4012	1012	e576d7f.exe	SearchApp.exe
PID 1012 wrote to memory of 3844	1012	e576d7f.exe	RuntimeBroker.exe
PID 1012 wrote to memory of 2308	1012	e576d7f.exe	RuntimeBroker.exe
PID 1012 wrote to memory of 548	1012	e576d7f.exe	TextInputHost.exe
PID 1012 wrote to memory of 536	1012	e576d7f.exe	e576ed7.exe
PID 1012 wrote to memory of 536	1012	e576d7f.exe	e576ed7.exe
PID 1012 wrote to memory of 2644	1012	e576d7f.exe	e578973.exe
PID 1012 wrote to memory of 2644	1012	e576d7f.exe	e578973.exe
PID 536 wrote to memory of 776	536	e576ed7.exe	fontdrvhost.exe
PID 536 wrote to memory of 784	536	e576ed7.exe	fontdrvhost.exe
PID 536 wrote to memory of 1020	536	e576ed7.exe	dwm.exe
PID 536 wrote to memory of 2768	536	e576ed7.exe	sihost.exe
PID 536 wrote to memory of 2872	536	e576ed7.exe	svchost.exe
PID 536 wrote to memory of 1428	536	e576ed7.exe	taskhostw.exe
PID 536 wrote to memory of 3416	536	e576ed7.exe	Explorer.EXE
PID 536 wrote to memory of 3548	536	e576ed7.exe	svchost.exe
PID 536 wrote to memory of 3752	536	e576ed7.exe	DllHost.exe
PID 536 wrote to memory of 3860	536	e576ed7.exe	StartMenuExperienceHost.exe
PID 536 wrote to memory of 3924	536	e576ed7.exe	RuntimeBroker.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

e576d7f.exee576ed7.exee578973.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576d7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578973.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2872

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:1428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3416

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c12627263858757c96a5c4457e80aefbf2b31679194d68f36dac0f0e3adc38b_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c12627263858757c96a5c4457e80aefbf2b31679194d68f36dac0f0e3adc38b_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:4276

C:\Users\Admin\AppData\Local\Temp\e576d7f.exe
C:\Users\Admin\AppData\Local\Temp\e576d7f.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1012

C:\Users\Admin\AppData\Local\Temp\e576ed7.exe
C:\Users\Admin\AppData\Local\Temp\e576ed7.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:536

C:\Users\Admin\AppData\Local\Temp\e578973.exe
C:\Users\Admin\AppData\Local\Temp\e578973.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3752

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3924

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2308

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:548

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e576d7f.exe
Filesize
97KB

MD5
5a54091cc7dbb33124897778859db44d

SHA1
ef2e9fe6d360fb174e37e204abced6bd558aa950

SHA256
b360657e0bfd80e1cd7642c1e71272cf0627e251db63bd9bf03e7007bd818b04

SHA512
8a0fbaa801e8596fe0413e01311cfc1b6529c473463bc7279c3d8e749f79f6dd4d9988402c3543bc0a0706e83b20cf78f31bbce62fba2e86929b274098ee37f2

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
a10b0193223878117efa70361cd9b387

SHA1
3de07d9be72bc9911fe1dc9fccc67bfe7f753717

SHA256
c897e251655d7708882bed4275111cafe168a267b9a8ffaf199584ccceb3c1ac

SHA512
85627293740b306c8b70c2789f4cc5268aa00fc1f015c1e24ff8da9b4a1fec8addfc04727e46bd04c4ee58495d4b0b2b228b9be15636a4c7be2b7dbf43bd1305

Download Submit
memory/536-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/536-153-0x0000000000B40000-0x0000000001BFA000-memory.dmp

Filesize
16.7MB

Download
memory/536-127-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/536-128-0x0000000000B40000-0x0000000001BFA000-memory.dmp

Filesize
16.7MB

Download
memory/536-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/536-59-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/536-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1012-72-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-56-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-35-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-30-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/1012-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1012-9-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-22-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

Filesize
4KB

Download
memory/1012-29-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/1012-11-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-18-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-8-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-10-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-6-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-37-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-38-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-39-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-40-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-41-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-43-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-44-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-103-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1012-53-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-55-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-33-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-86-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-36-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-94-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/1012-83-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-28-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-17-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-66-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-68-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-71-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-82-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-75-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-76-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1012-80-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2644-62-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2644-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2644-65-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2644-49-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-151-0x0000000000B30000-0x0000000001BEA000-memory.dmp

Filesize
16.7MB

Download
memory/2644-152-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4276-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4276-19-0x0000000000F70000-0x0000000000F72000-memory.dmp

Filesize
8KB

Download
memory/4276-23-0x0000000000F70000-0x0000000000F72000-memory.dmp

Filesize
8KB

Download
memory/4276-26-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/4276-27-0x0000000000F70000-0x0000000000F72000-memory.dmp

Filesize
8KB

Download