sality | 0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17_NeikiAnalytics.dll
Size

120KB
MD5

7ab39f0c4fafd69063933a71631ee7b0
SHA1

66ec13af73bf31dbb13652112a228ef4490bfb02
SHA256

0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17
SHA512

b197da767ab80f0b46ce5b2095ad972433a82fe45537e8ab1c842dd5a947e2c20c318c04f5b2213f9410853894880f7786ce7f714806466c52149f5e5d4c343e
SSDEEP

3072:mDWepspMFJVFUTDOa0bsNFyKCPZXwoiE:wspMWDO9b6kwoi

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e5742e5.exee575e0e.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e575e0e.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e575e0e.exee5742e5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5742e5.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5742e5.exee575e0e.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575e0e.exe

Executes dropped EXE 3 IoCs

Processes:

e5742e5.exee574575.exee575e0e.exe

pid process

3580 e5742e5.exe
1392 e574575.exe
4076 e575e0e.exe

pid	process
3580	e5742e5.exe
1392	e574575.exe
4076	e575e0e.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3580-6-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-19-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-12-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-10-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-11-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-9-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-21-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-20-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-18-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-28-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-36-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-37-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-38-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-39-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-40-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-42-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-43-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-53-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-55-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-56-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-67-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-68-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-71-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-74-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-75-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-77-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-79-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-81-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-82-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/3580-84-0x00000000007E0000-0x000000000189A000-memory.dmp	upx
behavioral2/memory/4076-119-0x0000000000B50000-0x0000000001C0A000-memory.dmp	upx
behavioral2/memory/4076-149-0x0000000000B50000-0x0000000001C0A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e575e0e.exee5742e5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5742e5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575e0e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e575e0e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5742e5.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e5742e5.exee575e0e.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575e0e.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e5742e5.exee575e0e.exe

description	ioc	process
File opened (read-only)	\??\G:	e5742e5.exe
File opened (read-only)	\??\H:	e5742e5.exe
File opened (read-only)	\??\S:	e5742e5.exe
File opened (read-only)	\??\K:	e5742e5.exe
File opened (read-only)	\??\L:	e5742e5.exe
File opened (read-only)	\??\M:	e5742e5.exe
File opened (read-only)	\??\E:	e575e0e.exe
File opened (read-only)	\??\O:	e5742e5.exe
File opened (read-only)	\??\P:	e5742e5.exe
File opened (read-only)	\??\Q:	e5742e5.exe
File opened (read-only)	\??\R:	e5742e5.exe
File opened (read-only)	\??\E:	e5742e5.exe
File opened (read-only)	\??\I:	e5742e5.exe
File opened (read-only)	\??\J:	e5742e5.exe
File opened (read-only)	\??\N:	e5742e5.exe

Drops file in Program Files directory 4 IoCs

Processes:

e5742e5.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e5742e5.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e5742e5.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e5742e5.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e5742e5.exe

Drops file in Windows directory 3 IoCs

Processes:

e5742e5.exee575e0e.exe

description ioc process

File created C:\Windows\e574362 e5742e5.exe
File opened for modification C:\Windows\SYSTEM.INI e5742e5.exe
File created C:\Windows\e5794be e575e0e.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e5742e5.exee575e0e.exe

pid process

3580 e5742e5.exe
3580 e5742e5.exe
3580 e5742e5.exe
3580 e5742e5.exe
4076 e575e0e.exe
4076 e575e0e.exe

description	ioc	process
File created	C:\Windows\e574362	e5742e5.exe
File opened for modification	C:\Windows\SYSTEM.INI	e5742e5.exe
File created	C:\Windows\e5794be	e575e0e.exe

pid	process
3580	e5742e5.exe
3580	e5742e5.exe
3580	e5742e5.exe
3580	e5742e5.exe
4076	e575e0e.exe
4076	e575e0e.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e5742e5.exe

description	pid	process
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe
Token: SeDebugPrivilege	3580	e5742e5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee5742e5.exee575e0e.exe

description	pid	process	target process
PID 956 wrote to memory of 3564	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 3564	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 3564	956	rundll32.exe	rundll32.exe
PID 3564 wrote to memory of 3580	3564	rundll32.exe	e5742e5.exe
PID 3564 wrote to memory of 3580	3564	rundll32.exe	e5742e5.exe
PID 3564 wrote to memory of 3580	3564	rundll32.exe	e5742e5.exe
PID 3580 wrote to memory of 768	3580	e5742e5.exe	fontdrvhost.exe
PID 3580 wrote to memory of 776	3580	e5742e5.exe	fontdrvhost.exe
PID 3580 wrote to memory of 384	3580	e5742e5.exe	dwm.exe
PID 3580 wrote to memory of 2672	3580	e5742e5.exe	sihost.exe
PID 3580 wrote to memory of 2688	3580	e5742e5.exe	svchost.exe
PID 3580 wrote to memory of 2800	3580	e5742e5.exe	taskhostw.exe
PID 3580 wrote to memory of 3556	3580	e5742e5.exe	Explorer.EXE
PID 3580 wrote to memory of 3700	3580	e5742e5.exe	svchost.exe
PID 3580 wrote to memory of 3880	3580	e5742e5.exe	DllHost.exe
PID 3580 wrote to memory of 3980	3580	e5742e5.exe	StartMenuExperienceHost.exe
PID 3580 wrote to memory of 4044	3580	e5742e5.exe	RuntimeBroker.exe
PID 3580 wrote to memory of 1464	3580	e5742e5.exe	SearchApp.exe
PID 3580 wrote to memory of 4156	3580	e5742e5.exe	RuntimeBroker.exe
PID 3580 wrote to memory of 2276	3580	e5742e5.exe	TextInputHost.exe
PID 3580 wrote to memory of 4596	3580	e5742e5.exe	RuntimeBroker.exe
PID 3580 wrote to memory of 956	3580	e5742e5.exe	rundll32.exe
PID 3580 wrote to memory of 3564	3580	e5742e5.exe	rundll32.exe
PID 3580 wrote to memory of 3564	3580	e5742e5.exe	rundll32.exe
PID 3564 wrote to memory of 1392	3564	rundll32.exe	e574575.exe
PID 3564 wrote to memory of 1392	3564	rundll32.exe	e574575.exe
PID 3564 wrote to memory of 1392	3564	rundll32.exe	e574575.exe
PID 3564 wrote to memory of 4076	3564	rundll32.exe	e575e0e.exe
PID 3564 wrote to memory of 4076	3564	rundll32.exe	e575e0e.exe
PID 3564 wrote to memory of 4076	3564	rundll32.exe	e575e0e.exe
PID 3580 wrote to memory of 768	3580	e5742e5.exe	fontdrvhost.exe
PID 3580 wrote to memory of 776	3580	e5742e5.exe	fontdrvhost.exe
PID 3580 wrote to memory of 384	3580	e5742e5.exe	dwm.exe
PID 3580 wrote to memory of 2672	3580	e5742e5.exe	sihost.exe
PID 3580 wrote to memory of 2688	3580	e5742e5.exe	svchost.exe
PID 3580 wrote to memory of 2800	3580	e5742e5.exe	taskhostw.exe
PID 3580 wrote to memory of 3556	3580	e5742e5.exe	Explorer.EXE
PID 3580 wrote to memory of 3700	3580	e5742e5.exe	svchost.exe
PID 3580 wrote to memory of 3880	3580	e5742e5.exe	DllHost.exe
PID 3580 wrote to memory of 3980	3580	e5742e5.exe	StartMenuExperienceHost.exe
PID 3580 wrote to memory of 4044	3580	e5742e5.exe	RuntimeBroker.exe
PID 3580 wrote to memory of 1464	3580	e5742e5.exe	SearchApp.exe
PID 3580 wrote to memory of 4156	3580	e5742e5.exe	RuntimeBroker.exe
PID 3580 wrote to memory of 2276	3580	e5742e5.exe	TextInputHost.exe
PID 3580 wrote to memory of 4596	3580	e5742e5.exe	RuntimeBroker.exe
PID 3580 wrote to memory of 1392	3580	e5742e5.exe	e574575.exe
PID 3580 wrote to memory of 1392	3580	e5742e5.exe	e574575.exe
PID 3580 wrote to memory of 4076	3580	e5742e5.exe	e575e0e.exe
PID 3580 wrote to memory of 4076	3580	e5742e5.exe	e575e0e.exe
PID 4076 wrote to memory of 768	4076	e575e0e.exe	fontdrvhost.exe
PID 4076 wrote to memory of 776	4076	e575e0e.exe	fontdrvhost.exe
PID 4076 wrote to memory of 384	4076	e575e0e.exe	dwm.exe
PID 4076 wrote to memory of 2672	4076	e575e0e.exe	sihost.exe
PID 4076 wrote to memory of 2688	4076	e575e0e.exe	svchost.exe
PID 4076 wrote to memory of 2800	4076	e575e0e.exe	taskhostw.exe
PID 4076 wrote to memory of 3556	4076	e575e0e.exe	Explorer.EXE
PID 4076 wrote to memory of 3700	4076	e575e0e.exe	svchost.exe
PID 4076 wrote to memory of 3880	4076	e575e0e.exe	DllHost.exe
PID 4076 wrote to memory of 3980	4076	e575e0e.exe	StartMenuExperienceHost.exe
PID 4076 wrote to memory of 4044	4076	e575e0e.exe	RuntimeBroker.exe
PID 4076 wrote to memory of 1464	4076	e575e0e.exe	SearchApp.exe
PID 4076 wrote to memory of 4156	4076	e575e0e.exe	RuntimeBroker.exe
PID 4076 wrote to memory of 2276	4076	e575e0e.exe	TextInputHost.exe
PID 4076 wrote to memory of 4596	4076	e575e0e.exe	RuntimeBroker.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e5742e5.exee575e0e.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5742e5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575e0e.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:384

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2688

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2800

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3556

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:3564

C:\Users\Admin\AppData\Local\Temp\e5742e5.exe
C:\Users\Admin\AppData\Local\Temp\e5742e5.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3580

C:\Users\Admin\AppData\Local\Temp\e574575.exe
C:\Users\Admin\AppData\Local\Temp\e574575.exe
4⤵
- Executes dropped EXE
PID:1392

C:\Users\Admin\AppData\Local\Temp\e575e0e.exe
C:\Users\Admin\AppData\Local\Temp\e575e0e.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3700

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3880

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3980

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4044

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1464

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4156

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2276

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4596

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e5742e5.exe
Filesize
97KB

MD5
f7475bb3248cccbf83f2798850c4ec74

SHA1
8492237f2e165e3f9376228a0f51e377e9a41937

SHA256
0cfb56aaefd721b772d6fc60b15c8bf4b557261d715bc0df34f9806b0327ea16

SHA512
b024a03c7ab27dabae991cad0f7db2004c609500a3f1c714064416b9c95730002c48b6256c0bb05c0127918c6e8e078a8c17f3a2ad3985313d5c565f334d7946

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
ac770d8fc933a8e4b6215b3c52d9ad20

SHA1
bd5fa4ba83e320a3cd9e7c57ee186e0d8d03c86c

SHA256
94f40e7cadae0ac3ba68d1d6993b6babe2dcecab055c63c16cc421bb6b9e3950

SHA512
255ee304eeb09822b616d328e73e8ed561f6adf94e15507743d3e3c9e16e30ed2de284b2778da8f6f078cb09e09f6327bdd6f7c54caa55f9319ccd8cd3308c16

Download Submit
memory/1392-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1392-107-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1392-59-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1392-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1392-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3564-30-0x00000000007D0000-0x00000000007E4000-memory.dmp

Filesize
80KB

Download
memory/3564-48-0x00000000011F0000-0x00000000011F2000-memory.dmp

Filesize
8KB

Download
memory/3564-51-0x00000000007D0000-0x00000000007E4000-memory.dmp

Filesize
80KB

Download
memory/3564-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3564-26-0x00000000011F0000-0x00000000011F2000-memory.dmp

Filesize
8KB

Download
memory/3564-22-0x00000000011F0000-0x00000000011F2000-memory.dmp

Filesize
8KB

Download
memory/3564-23-0x0000000004020000-0x0000000004021000-memory.dmp

Filesize
4KB

Download
memory/3580-43-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-77-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-34-0x0000000001AB0000-0x0000000001AB2000-memory.dmp

Filesize
8KB

Download
memory/3580-31-0x0000000001AB0000-0x0000000001AB2000-memory.dmp

Filesize
8KB

Download
memory/3580-20-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-18-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-28-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-36-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-37-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-38-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-39-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-40-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-42-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-25-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

Filesize
4KB

Download
memory/3580-9-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3580-11-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-53-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-55-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-56-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-10-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-6-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-103-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3580-12-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-91-0x0000000001AB0000-0x0000000001AB2000-memory.dmp

Filesize
8KB

Download
memory/3580-19-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-67-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-68-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-71-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-74-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-75-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-21-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-79-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-81-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-82-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/3580-84-0x00000000007E0000-0x000000000189A000-memory.dmp

Filesize
16.7MB

Download
memory/4076-62-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4076-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4076-65-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4076-52-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4076-119-0x0000000000B50000-0x0000000001C0A000-memory.dmp

Filesize
16.7MB

Download
memory/4076-150-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4076-149-0x0000000000B50000-0x0000000001C0A000-memory.dmp

Filesize
16.7MB

Download