sality | 713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c.dll
Size

120KB
MD5

f8406647db957a8e412f87f264750762
SHA1

2c583c73d2149c1cf7c48e86d220d91027459663
SHA256

713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c
SHA512

5292f186da834d04f85150a6f093c631e0100085d1a1a6c1287d7f1d7f269a2d0f05ee4681f2875a7b69094d21f08abb7948885aa524846bf82b8fc7153a7595
SSDEEP

1536:3MX0jYUqppB21PAZRhY1y8KPl4jXq6mv88/HyyxFS+NQ2noh30PmhBs9OFVwo+Lm:3MEspBQAPhY1tKP+jXqXyyhm30uqBE

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e5756cb.exee577280.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e5756cb.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5756cb.exee577280.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577280.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e577280.exee5756cb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577280.exe

Executes dropped EXE 3 IoCs

Processes:

e5756cb.exee5758ed.exee577280.exe

pid process

2808 e5756cb.exe
4244 e5758ed.exe
4496 e577280.exe

pid	process
2808	e5756cb.exe
4244	e5758ed.exe
4496	e577280.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2808-8-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-12-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-10-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-9-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-20-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-22-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-21-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-19-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-13-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-11-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-36-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-37-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-38-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-39-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-40-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-42-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-43-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-52-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-54-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-55-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-65-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-66-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-70-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-71-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-73-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-74-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-75-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-78-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-80-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-82-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2808-94-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4496-123-0x0000000000B30000-0x0000000001BEA000-memory.dmp	upx
behavioral2/memory/4496-153-0x0000000000B30000-0x0000000001BEA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e577280.exee5756cb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577280.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5756cb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577280.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e5756cb.exee577280.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577280.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e5756cb.exee577280.exe

description	ioc	process
File opened (read-only)	\??\L:	e5756cb.exe
File opened (read-only)	\??\P:	e5756cb.exe
File opened (read-only)	\??\Q:	e5756cb.exe
File opened (read-only)	\??\G:	e5756cb.exe
File opened (read-only)	\??\I:	e5756cb.exe
File opened (read-only)	\??\R:	e5756cb.exe
File opened (read-only)	\??\S:	e5756cb.exe
File opened (read-only)	\??\H:	e5756cb.exe
File opened (read-only)	\??\O:	e5756cb.exe
File opened (read-only)	\??\M:	e5756cb.exe
File opened (read-only)	\??\N:	e5756cb.exe
File opened (read-only)	\??\E:	e577280.exe
File opened (read-only)	\??\E:	e5756cb.exe
File opened (read-only)	\??\J:	e5756cb.exe
File opened (read-only)	\??\K:	e5756cb.exe

Drops file in Program Files directory 4 IoCs

Processes:

e5756cb.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e5756cb.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e5756cb.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e5756cb.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	e5756cb.exe

Drops file in Windows directory 3 IoCs

Processes:

e5756cb.exee577280.exe

description ioc process

File created C:\Windows\e575728 e5756cb.exe
File opened for modification C:\Windows\SYSTEM.INI e5756cb.exe
File created C:\Windows\e57a856 e577280.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e5756cb.exee577280.exe

pid process

2808 e5756cb.exe
2808 e5756cb.exe
2808 e5756cb.exe
2808 e5756cb.exe
4496 e577280.exe
4496 e577280.exe

description	ioc	process
File created	C:\Windows\e575728	e5756cb.exe
File opened for modification	C:\Windows\SYSTEM.INI	e5756cb.exe
File created	C:\Windows\e57a856	e577280.exe

pid	process
2808	e5756cb.exe
2808	e5756cb.exe
2808	e5756cb.exe
2808	e5756cb.exe
4496	e577280.exe
4496	e577280.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e5756cb.exe

description	pid	process
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe
Token: SeDebugPrivilege	2808	e5756cb.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee5756cb.exee577280.exe

description	pid	process	target process
PID 968 wrote to memory of 2272	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 2272	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 2272	968	rundll32.exe	rundll32.exe
PID 2272 wrote to memory of 2808	2272	rundll32.exe	e5756cb.exe
PID 2272 wrote to memory of 2808	2272	rundll32.exe	e5756cb.exe
PID 2272 wrote to memory of 2808	2272	rundll32.exe	e5756cb.exe
PID 2808 wrote to memory of 792	2808	e5756cb.exe	fontdrvhost.exe
PID 2808 wrote to memory of 796	2808	e5756cb.exe	fontdrvhost.exe
PID 2808 wrote to memory of 316	2808	e5756cb.exe	dwm.exe
PID 2808 wrote to memory of 2660	2808	e5756cb.exe	sihost.exe
PID 2808 wrote to memory of 2672	2808	e5756cb.exe	svchost.exe
PID 2808 wrote to memory of 2884	2808	e5756cb.exe	taskhostw.exe
PID 2808 wrote to memory of 3480	2808	e5756cb.exe	Explorer.EXE
PID 2808 wrote to memory of 3600	2808	e5756cb.exe	svchost.exe
PID 2808 wrote to memory of 3780	2808	e5756cb.exe	DllHost.exe
PID 2808 wrote to memory of 3876	2808	e5756cb.exe	StartMenuExperienceHost.exe
PID 2808 wrote to memory of 3944	2808	e5756cb.exe	RuntimeBroker.exe
PID 2808 wrote to memory of 4024	2808	e5756cb.exe	SearchApp.exe
PID 2808 wrote to memory of 4060	2808	e5756cb.exe	RuntimeBroker.exe
PID 2808 wrote to memory of 4436	2808	e5756cb.exe	RuntimeBroker.exe
PID 2808 wrote to memory of 1224	2808	e5756cb.exe	TextInputHost.exe
PID 2808 wrote to memory of 968	2808	e5756cb.exe	rundll32.exe
PID 2808 wrote to memory of 2272	2808	e5756cb.exe	rundll32.exe
PID 2808 wrote to memory of 2272	2808	e5756cb.exe	rundll32.exe
PID 2272 wrote to memory of 4244	2272	rundll32.exe	e5758ed.exe
PID 2272 wrote to memory of 4244	2272	rundll32.exe	e5758ed.exe
PID 2272 wrote to memory of 4244	2272	rundll32.exe	e5758ed.exe
PID 2272 wrote to memory of 4496	2272	rundll32.exe	e577280.exe
PID 2272 wrote to memory of 4496	2272	rundll32.exe	e577280.exe
PID 2272 wrote to memory of 4496	2272	rundll32.exe	e577280.exe
PID 2808 wrote to memory of 792	2808	e5756cb.exe	fontdrvhost.exe
PID 2808 wrote to memory of 796	2808	e5756cb.exe	fontdrvhost.exe
PID 2808 wrote to memory of 316	2808	e5756cb.exe	dwm.exe
PID 2808 wrote to memory of 2660	2808	e5756cb.exe	sihost.exe
PID 2808 wrote to memory of 2672	2808	e5756cb.exe	svchost.exe
PID 2808 wrote to memory of 2884	2808	e5756cb.exe	taskhostw.exe
PID 2808 wrote to memory of 3480	2808	e5756cb.exe	Explorer.EXE
PID 2808 wrote to memory of 3600	2808	e5756cb.exe	svchost.exe
PID 2808 wrote to memory of 3780	2808	e5756cb.exe	DllHost.exe
PID 2808 wrote to memory of 3876	2808	e5756cb.exe	StartMenuExperienceHost.exe
PID 2808 wrote to memory of 3944	2808	e5756cb.exe	RuntimeBroker.exe
PID 2808 wrote to memory of 4024	2808	e5756cb.exe	SearchApp.exe
PID 2808 wrote to memory of 4060	2808	e5756cb.exe	RuntimeBroker.exe
PID 2808 wrote to memory of 4436	2808	e5756cb.exe	RuntimeBroker.exe
PID 2808 wrote to memory of 1224	2808	e5756cb.exe	TextInputHost.exe
PID 2808 wrote to memory of 4244	2808	e5756cb.exe	e5758ed.exe
PID 2808 wrote to memory of 4244	2808	e5756cb.exe	e5758ed.exe
PID 2808 wrote to memory of 4496	2808	e5756cb.exe	e577280.exe
PID 2808 wrote to memory of 4496	2808	e5756cb.exe	e577280.exe
PID 4496 wrote to memory of 792	4496	e577280.exe	fontdrvhost.exe
PID 4496 wrote to memory of 796	4496	e577280.exe	fontdrvhost.exe
PID 4496 wrote to memory of 316	4496	e577280.exe	dwm.exe
PID 4496 wrote to memory of 2660	4496	e577280.exe	sihost.exe
PID 4496 wrote to memory of 2672	4496	e577280.exe	svchost.exe
PID 4496 wrote to memory of 2884	4496	e577280.exe	taskhostw.exe
PID 4496 wrote to memory of 3480	4496	e577280.exe	Explorer.EXE
PID 4496 wrote to memory of 3600	4496	e577280.exe	svchost.exe
PID 4496 wrote to memory of 3780	4496	e577280.exe	DllHost.exe
PID 4496 wrote to memory of 3876	4496	e577280.exe	StartMenuExperienceHost.exe
PID 4496 wrote to memory of 3944	4496	e577280.exe	RuntimeBroker.exe
PID 4496 wrote to memory of 4024	4496	e577280.exe	SearchApp.exe
PID 4496 wrote to memory of 4060	4496	e577280.exe	RuntimeBroker.exe
PID 4496 wrote to memory of 4436	4496	e577280.exe	RuntimeBroker.exe
PID 4496 wrote to memory of 1224	4496	e577280.exe	TextInputHost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e5756cb.exee577280.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5756cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577280.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:316

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2672

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2884

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3480

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Users\Admin\AppData\Local\Temp\e5756cb.exe
C:\Users\Admin\AppData\Local\Temp\e5756cb.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2808

C:\Users\Admin\AppData\Local\Temp\e5758ed.exe
C:\Users\Admin\AppData\Local\Temp\e5758ed.exe
4⤵
- Executes dropped EXE
PID:4244

C:\Users\Admin\AppData\Local\Temp\e577280.exe
C:\Users\Admin\AppData\Local\Temp\e577280.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3600

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3780

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3876

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3944

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4024

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4060

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1224

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e5756cb.exe
Filesize
97KB

MD5
460deea74188ca0c9eba550e8cb11b95

SHA1
f77f3477797862e89f18f7e30f615dab4fc93d28

SHA256
194cb2ea60024645c01298fa56a2b93ec5df2d099e5d378f8dbeb2449307f38e

SHA512
5d10bf5d3ce530901c63cf4827e451a4b767d56b893040e4b5914170b0749671f3d653e521be9bebb59fbb6183dcc39e2b319e821fca76d4173f26661707ec86

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
8f062a0e3a7577f717710516ce078031

SHA1
bcb01cfcff268516643cab5a09212603b3f3490c

SHA256
3b874d1bd4ad9878780162d5cf6eab61b1da6e93fee04acff13609b4eeecdc26

SHA512
de699784ba6a7f4ab680fef29819a615d6255b787f80190dfe74d50ef969e9cc476bd08762707cbdc720096ff29ca82964559d62bad2f06d44abf78bdc3e538c

Download Submit
memory/2272-31-0x0000000000F90000-0x0000000000F92000-memory.dmp

Filesize
8KB

Download
memory/2272-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2272-23-0x0000000000F90000-0x0000000000F92000-memory.dmp

Filesize
8KB

Download
memory/2272-24-0x0000000000F90000-0x0000000000F92000-memory.dmp

Filesize
8KB

Download
memory/2272-25-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/2808-52-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-75-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-22-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-32-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/2808-20-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-30-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/2808-28-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/2808-9-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-10-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-12-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-21-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-19-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-13-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-11-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-36-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-37-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-38-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-39-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-40-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-42-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-43-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-8-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2808-54-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-55-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-95-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/2808-94-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-107-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2808-82-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-65-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-66-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-80-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-78-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-70-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-71-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-73-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/2808-74-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4244-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4244-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4244-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4244-111-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4244-58-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4496-61-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4496-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4496-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4496-51-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4496-123-0x0000000000B30000-0x0000000001BEA000-memory.dmp

Filesize
16.7MB

Download
memory/4496-154-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4496-153-0x0000000000B30000-0x0000000001BEA000-memory.dmp

Filesize
16.7MB

Download