sality | a30fbb4160a6e9e86820a0907f3449793000347c8d9ae7a798e02f58c4e75012

Analysis

max time kernel
139s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a30fbb4160a6e9e86820a0907f3449793000347c8d9ae7a798e02f58c4e75012.dll
Size

120KB
MD5

59140edd24e1c5bf3d92ba2cd4b925ea
SHA1

122efca764ab0f44905ab63e543b97489acca107
SHA256

a30fbb4160a6e9e86820a0907f3449793000347c8d9ae7a798e02f58c4e75012
SHA512

a0f9e8c93097fed8fac953ef11e92a76faef8367d288ca67597d281800513dc813dd28314fe0e669d1550c4ad743683cbe3ddb4f3b4fadf64660c008b6d9dd4f
SSDEEP

1536:Yhi2MMP9I6KzTTe6N1WqivfB41XbPusXDHBXTXnw0KWvrGr+rM684pd8wf:uX9ZKPTecnivfB4tb2cFTg0KWv4+r

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e5736fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e5736fe.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

e5736fe.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5736fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5736fe.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5736fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5736fe.exe

Executes dropped EXE 4 IoCs

Processes:

e5736fe.exee573808.exee575592.exee5755a2.exe

pid process

1448 e5736fe.exe
2888 e573808.exe
5080 e575592.exe
3980 e5755a2.exe

pid	process
1448	e5736fe.exe
2888	e573808.exe
5080	e575592.exe
3980	e5755a2.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1448-8-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-11-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-10-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-9-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-26-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-30-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-25-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-27-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-12-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-36-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-37-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-38-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-39-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-40-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-41-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-57-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-58-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-59-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-73-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-75-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-77-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-79-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-82-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-83-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-86-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-87-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-88-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-89-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-91-0x0000000000790000-0x000000000184A000-memory.dmp	upx
behavioral2/memory/1448-92-0x0000000000790000-0x000000000184A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5736fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5736fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5736fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5736fe.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

e5736fe.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5736fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5736fe.exe

Enumerates connected drives 3 TTPs 13 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e5736fe.exe

description	ioc	process
File opened (read-only)	\??\E:	e5736fe.exe
File opened (read-only)	\??\J:	e5736fe.exe
File opened (read-only)	\??\L:	e5736fe.exe
File opened (read-only)	\??\N:	e5736fe.exe
File opened (read-only)	\??\O:	e5736fe.exe
File opened (read-only)	\??\I:	e5736fe.exe
File opened (read-only)	\??\M:	e5736fe.exe
File opened (read-only)	\??\Q:	e5736fe.exe
File opened (read-only)	\??\H:	e5736fe.exe
File opened (read-only)	\??\K:	e5736fe.exe
File opened (read-only)	\??\P:	e5736fe.exe
File opened (read-only)	\??\R:	e5736fe.exe
File opened (read-only)	\??\G:	e5736fe.exe

Drops file in Program Files directory 4 IoCs

Processes:

e5736fe.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e5736fe.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e5736fe.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e5736fe.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e5736fe.exe

Drops file in Windows directory 2 IoCs

Processes:

e5736fe.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI e5736fe.exe
File created C:\Windows\e57375c e5736fe.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e5736fe.exe

pid process

1448 e5736fe.exe
1448 e5736fe.exe
1448 e5736fe.exe
1448 e5736fe.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	e5736fe.exe
File created	C:\Windows\e57375c	e5736fe.exe

pid	process
1448	e5736fe.exe
1448	e5736fe.exe
1448	e5736fe.exe
1448	e5736fe.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e5736fe.exe

description	pid	process
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe
Token: SeDebugPrivilege	1448	e5736fe.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

rundll32.exerundll32.exee5736fe.exe

description	pid	process	target process
PID 2628 wrote to memory of 4384	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 4384	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 4384	2628	rundll32.exe	rundll32.exe
PID 4384 wrote to memory of 1448	4384	rundll32.exe	e5736fe.exe
PID 4384 wrote to memory of 1448	4384	rundll32.exe	e5736fe.exe
PID 4384 wrote to memory of 1448	4384	rundll32.exe	e5736fe.exe
PID 1448 wrote to memory of 792	1448	e5736fe.exe	fontdrvhost.exe
PID 1448 wrote to memory of 788	1448	e5736fe.exe	fontdrvhost.exe
PID 1448 wrote to memory of 384	1448	e5736fe.exe	dwm.exe
PID 1448 wrote to memory of 2252	1448	e5736fe.exe	sihost.exe
PID 1448 wrote to memory of 2632	1448	e5736fe.exe	svchost.exe
PID 1448 wrote to memory of 3124	1448	e5736fe.exe	taskhostw.exe
PID 1448 wrote to memory of 3468	1448	e5736fe.exe	Explorer.EXE
PID 1448 wrote to memory of 3580	1448	e5736fe.exe	svchost.exe
PID 1448 wrote to memory of 3760	1448	e5736fe.exe	DllHost.exe
PID 1448 wrote to memory of 3852	1448	e5736fe.exe	StartMenuExperienceHost.exe
PID 1448 wrote to memory of 3916	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 3996	1448	e5736fe.exe	SearchApp.exe
PID 1448 wrote to memory of 3624	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 2012	1448	e5736fe.exe	TextInputHost.exe
PID 1448 wrote to memory of 5048	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 3384	1448	e5736fe.exe	backgroundTaskHost.exe
PID 1448 wrote to memory of 2136	1448	e5736fe.exe	backgroundTaskHost.exe
PID 1448 wrote to memory of 2628	1448	e5736fe.exe	rundll32.exe
PID 1448 wrote to memory of 4384	1448	e5736fe.exe	rundll32.exe
PID 1448 wrote to memory of 4384	1448	e5736fe.exe	rundll32.exe
PID 4384 wrote to memory of 2888	4384	rundll32.exe	e573808.exe
PID 4384 wrote to memory of 2888	4384	rundll32.exe	e573808.exe
PID 4384 wrote to memory of 2888	4384	rundll32.exe	e573808.exe
PID 4384 wrote to memory of 5080	4384	rundll32.exe	e575592.exe
PID 4384 wrote to memory of 5080	4384	rundll32.exe	e575592.exe
PID 4384 wrote to memory of 5080	4384	rundll32.exe	e575592.exe
PID 4384 wrote to memory of 3980	4384	rundll32.exe	e5755a2.exe
PID 4384 wrote to memory of 3980	4384	rundll32.exe	e5755a2.exe
PID 4384 wrote to memory of 3980	4384	rundll32.exe	e5755a2.exe
PID 1448 wrote to memory of 792	1448	e5736fe.exe	fontdrvhost.exe
PID 1448 wrote to memory of 788	1448	e5736fe.exe	fontdrvhost.exe
PID 1448 wrote to memory of 384	1448	e5736fe.exe	dwm.exe
PID 1448 wrote to memory of 2252	1448	e5736fe.exe	sihost.exe
PID 1448 wrote to memory of 2632	1448	e5736fe.exe	svchost.exe
PID 1448 wrote to memory of 3124	1448	e5736fe.exe	taskhostw.exe
PID 1448 wrote to memory of 3468	1448	e5736fe.exe	Explorer.EXE
PID 1448 wrote to memory of 3580	1448	e5736fe.exe	svchost.exe
PID 1448 wrote to memory of 3760	1448	e5736fe.exe	DllHost.exe
PID 1448 wrote to memory of 3852	1448	e5736fe.exe	StartMenuExperienceHost.exe
PID 1448 wrote to memory of 3916	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 3996	1448	e5736fe.exe	SearchApp.exe
PID 1448 wrote to memory of 3624	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 2012	1448	e5736fe.exe	TextInputHost.exe
PID 1448 wrote to memory of 5048	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 3384	1448	e5736fe.exe	backgroundTaskHost.exe
PID 1448 wrote to memory of 2136	1448	e5736fe.exe	backgroundTaskHost.exe
PID 1448 wrote to memory of 2888	1448	e5736fe.exe	e573808.exe
PID 1448 wrote to memory of 2888	1448	e5736fe.exe	e573808.exe
PID 1448 wrote to memory of 4412	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 3388	1448	e5736fe.exe	RuntimeBroker.exe
PID 1448 wrote to memory of 2668	1448	e5736fe.exe	DllHost.exe
PID 1448 wrote to memory of 5080	1448	e5736fe.exe	e575592.exe
PID 1448 wrote to memory of 5080	1448	e5736fe.exe	e575592.exe
PID 1448 wrote to memory of 3980	1448	e5736fe.exe	e5755a2.exe
PID 1448 wrote to memory of 3980	1448	e5736fe.exe	e5755a2.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

e5736fe.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5736fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5736fe.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:384

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2632

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3124

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3468

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a30fbb4160a6e9e86820a0907f3449793000347c8d9ae7a798e02f58c4e75012.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a30fbb4160a6e9e86820a0907f3449793000347c8d9ae7a798e02f58c4e75012.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:4384

C:\Users\Admin\AppData\Local\Temp\e5736fe.exe
C:\Users\Admin\AppData\Local\Temp\e5736fe.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1448

C:\Users\Admin\AppData\Local\Temp\e573808.exe
C:\Users\Admin\AppData\Local\Temp\e573808.exe
4⤵
- Executes dropped EXE
PID:2888

C:\Users\Admin\AppData\Local\Temp\e575592.exe
C:\Users\Admin\AppData\Local\Temp\e575592.exe
4⤵
- Executes dropped EXE
PID:5080

C:\Users\Admin\AppData\Local\Temp\e5755a2.exe
C:\Users\Admin\AppData\Local\Temp\e5755a2.exe
4⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3760

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3916

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3996

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3624

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5048

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3384

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2136

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4412

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3388

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e5736fe.exe
Filesize
97KB

MD5
a99cf86fedfc069c9a7e9415617d0e70

SHA1
027206ebc558f7330c8844105a99fca8c1548650

SHA256
0dd5f7fb43af56ccb0dd8cd3418c8d7984f80162a809b314c1e6cba45e3c7e87

SHA512
b1654e1eccfc1796497a38cf0f0ea9024924aaea4080fc2c0dd75bd5ab4c35db5a5d8f044442129a9b6b30db72bf21dffa70047f2b4017db81d3655c7eca13a7

Download Submit
memory/1448-58-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-77-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-8-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-57-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-16-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1448-111-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1448-11-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-10-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-9-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-26-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-100-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/1448-30-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-34-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/1448-25-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-31-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/1448-92-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-91-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-27-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-12-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-36-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-37-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-38-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-89-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-40-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-41-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-88-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-39-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-87-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-86-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-59-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-83-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-82-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-79-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1448-75-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/1448-73-0x0000000000790000-0x000000000184A000-memory.dmp

Filesize
16.7MB

Download
memory/2888-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2888-61-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2888-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2888-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2888-115-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3980-68-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3980-71-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/3980-123-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3980-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4384-28-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/4384-17-0x00000000048C0000-0x00000000048C2000-memory.dmp

Filesize
8KB

Download
memory/4384-29-0x00000000048C0000-0x00000000048C2000-memory.dmp

Filesize
8KB

Download
memory/4384-13-0x00000000048C0000-0x00000000048C2000-memory.dmp

Filesize
8KB

Download
memory/4384-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/5080-49-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5080-66-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/5080-65-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5080-70-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/5080-119-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download