sality | a5c19e2e08d831407eb2bd1d81f1bacd9fad44de8cde992b4390ab12b668525a

Analysis

max time kernel
141s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5c19e2e08d831407eb2bd1d81f1bacd9fad44de8cde992b4390ab12b668525a.dll
Size

120KB
MD5

b33b5bd15daf9a9fdecfe349cfaf0c0d
SHA1

ec73cbacb9e23c13c9188ae22e047902773434c4
SHA256

a5c19e2e08d831407eb2bd1d81f1bacd9fad44de8cde992b4390ab12b668525a
SHA512

7c74312fd00e94200305c4f7ed8731c4276857d4502c93d806bc5cd18063c841e742b6b970bbecc08881abf39be6c8734a6038fd4679a9f53c16ad973a8b3bd2
SSDEEP

3072:+ELH6SZbIuWqixRTfMdeZHOmyIU1F3RZbR8tvd:+ELH5bLWqAHcHNXOvd

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e577138.exee574f29.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e577138.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574f29.exee577138.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577138.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574f29.exee577138.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577138.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3616-6-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-9-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-11-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-8-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-12-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-13-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-26-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-35-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-27-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-31-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-10-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-36-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-37-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-38-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-40-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-39-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-42-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-52-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-61-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-62-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-63-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-64-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-67-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-70-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-72-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/3616-75-0x0000000000900000-0x00000000019BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1428-108-0x0000000000B60000-0x0000000001C1A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1428-140-0x0000000000B60000-0x0000000001C1A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3616-5-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/3616-6-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-9-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-11-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-8-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-12-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-13-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-26-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-35-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-27-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/776-33-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/3616-31-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-10-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-36-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-37-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-38-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-40-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-39-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/1428-50-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/3616-42-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-52-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-61-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-62-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-63-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-64-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-67-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-70-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-72-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/3616-92-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/3616-75-0x0000000000900000-0x00000000019BA000-memory.dmp	UPX
behavioral2/memory/776-96-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/1428-108-0x0000000000B60000-0x0000000001C1A000-memory.dmp	UPX
behavioral2/memory/1428-141-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/1428-140-0x0000000000B60000-0x0000000001C1A000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

e574f29.exee575033.exee577138.exe

pid process

3616 e574f29.exe
776 e575033.exe
1428 e577138.exe

pid	process
3616	e574f29.exe
776	e575033.exe
1428	e577138.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3616-6-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-9-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-11-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-8-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-12-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-13-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-26-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-35-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-27-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-31-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-10-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-36-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-37-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-38-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-40-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-39-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-42-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-52-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-61-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-62-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-63-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-64-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-67-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-70-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-72-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/3616-75-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral2/memory/1428-108-0x0000000000B60000-0x0000000001C1A000-memory.dmp	upx
behavioral2/memory/1428-140-0x0000000000B60000-0x0000000001C1A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574f29.exee577138.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574f29.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577138.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577138.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e574f29.exee577138.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577138.exe

Enumerates connected drives 3 TTPs 11 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e574f29.exee577138.exe

description	ioc	process
File opened (read-only)	\??\H:	e574f29.exe
File opened (read-only)	\??\I:	e574f29.exe
File opened (read-only)	\??\L:	e574f29.exe
File opened (read-only)	\??\M:	e574f29.exe
File opened (read-only)	\??\E:	e577138.exe
File opened (read-only)	\??\E:	e574f29.exe
File opened (read-only)	\??\G:	e574f29.exe
File opened (read-only)	\??\J:	e574f29.exe
File opened (read-only)	\??\K:	e574f29.exe
File opened (read-only)	\??\N:	e574f29.exe
File opened (read-only)	\??\G:	e577138.exe

Drops file in Program Files directory 3 IoCs

Processes:

e574f29.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e574f29.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e574f29.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e574f29.exe

Drops file in Windows directory 3 IoCs

Processes:

e577138.exee574f29.exe

description ioc process

File created C:\Windows\e57a6a0 e577138.exe
File created C:\Windows\e574f97 e574f29.exe
File opened for modification C:\Windows\SYSTEM.INI e574f29.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e574f29.exee577138.exe

pid process

3616 e574f29.exe
3616 e574f29.exe
3616 e574f29.exe
3616 e574f29.exe
1428 e577138.exe
1428 e577138.exe

description	ioc	process
File created	C:\Windows\e57a6a0	e577138.exe
File created	C:\Windows\e574f97	e574f29.exe
File opened for modification	C:\Windows\SYSTEM.INI	e574f29.exe

pid	process
3616	e574f29.exe
3616	e574f29.exe
3616	e574f29.exe
3616	e574f29.exe
1428	e577138.exe
1428	e577138.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e574f29.exe

description	pid	process
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe
Token: SeDebugPrivilege	3616	e574f29.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee574f29.exee577138.exe

description	pid	process	target process
PID 1352 wrote to memory of 2576	1352	rundll32.exe	rundll32.exe
PID 1352 wrote to memory of 2576	1352	rundll32.exe	rundll32.exe
PID 1352 wrote to memory of 2576	1352	rundll32.exe	rundll32.exe
PID 2576 wrote to memory of 3616	2576	rundll32.exe	e574f29.exe
PID 2576 wrote to memory of 3616	2576	rundll32.exe	e574f29.exe
PID 2576 wrote to memory of 3616	2576	rundll32.exe	e574f29.exe
PID 3616 wrote to memory of 780	3616	e574f29.exe	fontdrvhost.exe
PID 3616 wrote to memory of 784	3616	e574f29.exe	fontdrvhost.exe
PID 3616 wrote to memory of 60	3616	e574f29.exe	dwm.exe
PID 3616 wrote to memory of 2788	3616	e574f29.exe	sihost.exe
PID 3616 wrote to memory of 2852	3616	e574f29.exe	svchost.exe
PID 3616 wrote to memory of 3056	3616	e574f29.exe	taskhostw.exe
PID 3616 wrote to memory of 3388	3616	e574f29.exe	Explorer.EXE
PID 3616 wrote to memory of 3496	3616	e574f29.exe	svchost.exe
PID 3616 wrote to memory of 3684	3616	e574f29.exe	DllHost.exe
PID 3616 wrote to memory of 3776	3616	e574f29.exe	StartMenuExperienceHost.exe
PID 3616 wrote to memory of 3844	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 3968	3616	e574f29.exe	SearchApp.exe
PID 3616 wrote to memory of 3288	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 4412	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 4192	3616	e574f29.exe	TextInputHost.exe
PID 3616 wrote to memory of 1096	3616	e574f29.exe	backgroundTaskHost.exe
PID 3616 wrote to memory of 4936	3616	e574f29.exe	backgroundTaskHost.exe
PID 3616 wrote to memory of 1352	3616	e574f29.exe	rundll32.exe
PID 3616 wrote to memory of 2576	3616	e574f29.exe	rundll32.exe
PID 3616 wrote to memory of 2576	3616	e574f29.exe	rundll32.exe
PID 2576 wrote to memory of 776	2576	rundll32.exe	e575033.exe
PID 2576 wrote to memory of 776	2576	rundll32.exe	e575033.exe
PID 2576 wrote to memory of 776	2576	rundll32.exe	e575033.exe
PID 2576 wrote to memory of 1428	2576	rundll32.exe	e577138.exe
PID 2576 wrote to memory of 1428	2576	rundll32.exe	e577138.exe
PID 2576 wrote to memory of 1428	2576	rundll32.exe	e577138.exe
PID 3616 wrote to memory of 780	3616	e574f29.exe	fontdrvhost.exe
PID 3616 wrote to memory of 784	3616	e574f29.exe	fontdrvhost.exe
PID 3616 wrote to memory of 60	3616	e574f29.exe	dwm.exe
PID 3616 wrote to memory of 2788	3616	e574f29.exe	sihost.exe
PID 3616 wrote to memory of 2852	3616	e574f29.exe	svchost.exe
PID 3616 wrote to memory of 3056	3616	e574f29.exe	taskhostw.exe
PID 3616 wrote to memory of 3388	3616	e574f29.exe	Explorer.EXE
PID 3616 wrote to memory of 3496	3616	e574f29.exe	svchost.exe
PID 3616 wrote to memory of 3684	3616	e574f29.exe	DllHost.exe
PID 3616 wrote to memory of 3776	3616	e574f29.exe	StartMenuExperienceHost.exe
PID 3616 wrote to memory of 3844	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 3968	3616	e574f29.exe	SearchApp.exe
PID 3616 wrote to memory of 3288	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 4412	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 4192	3616	e574f29.exe	TextInputHost.exe
PID 3616 wrote to memory of 1096	3616	e574f29.exe	backgroundTaskHost.exe
PID 3616 wrote to memory of 4936	3616	e574f29.exe	backgroundTaskHost.exe
PID 3616 wrote to memory of 776	3616	e574f29.exe	e575033.exe
PID 3616 wrote to memory of 776	3616	e574f29.exe	e575033.exe
PID 3616 wrote to memory of 4580	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 1964	3616	e574f29.exe	RuntimeBroker.exe
PID 3616 wrote to memory of 1428	3616	e574f29.exe	e577138.exe
PID 3616 wrote to memory of 1428	3616	e574f29.exe	e577138.exe
PID 1428 wrote to memory of 780	1428	e577138.exe	fontdrvhost.exe
PID 1428 wrote to memory of 784	1428	e577138.exe	fontdrvhost.exe
PID 1428 wrote to memory of 60	1428	e577138.exe	dwm.exe
PID 1428 wrote to memory of 2788	1428	e577138.exe	sihost.exe
PID 1428 wrote to memory of 2852	1428	e577138.exe	svchost.exe
PID 1428 wrote to memory of 3056	1428	e577138.exe	taskhostw.exe
PID 1428 wrote to memory of 3388	1428	e577138.exe	Explorer.EXE
PID 1428 wrote to memory of 3496	1428	e577138.exe	svchost.exe
PID 1428 wrote to memory of 3684	1428	e577138.exe	DllHost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e574f29.exee577138.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574f29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577138.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:60

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2852

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3056

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5c19e2e08d831407eb2bd1d81f1bacd9fad44de8cde992b4390ab12b668525a.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5c19e2e08d831407eb2bd1d81f1bacd9fad44de8cde992b4390ab12b668525a.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Users\Admin\AppData\Local\Temp\e574f29.exe
C:\Users\Admin\AppData\Local\Temp\e574f29.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3616

C:\Users\Admin\AppData\Local\Temp\e575033.exe
C:\Users\Admin\AppData\Local\Temp\e575033.exe
4⤵
- Executes dropped EXE
PID:776

C:\Users\Admin\AppData\Local\Temp\e577138.exe
C:\Users\Admin\AppData\Local\Temp\e577138.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3496

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3684

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3844

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3968

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3288

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4412

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4192

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:1096

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4936

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4580

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e574f29.exe
Filesize
97KB

MD5
6dd8c850eb829dbcacaca7d189f1d7dd

SHA1
12e329d94f1fd49ff442d3c649fdc1fe6471591d

SHA256
289470da480421c1fac9fbba8f3bbc89b756eccbb7ee50eb49f8f9f41b5aa9f3

SHA512
304cda5b42eed41a8da751a77238ae8f368cd477261596bc706e379643935b46f3cc17e6b62a265b49fc498d87f96e8f8dd648d343a7feebf69647821f12d2eb

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
7148fd33afc6b17d4906690b9cb6d217

SHA1
8c7a685e0ed165d647a7dab443900d48c472a955

SHA256
5332441fa9c390fe79c69c5efb06224cf44388d78656c33fe93c9d199069931d

SHA512
4b692182da4f15e6116e9a0ad8fcca467334440a02e8cc103a48ffbadb05a87e59a0bf31127ee221d6c8134c9f4af565e11b44d180ef0ae55136f75996b2e2c3

Download Submit
memory/776-54-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/776-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/776-33-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/776-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/776-96-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1428-56-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1428-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1428-108-0x0000000000B60000-0x0000000001C1A000-memory.dmp

Filesize
16.7MB

Download
memory/1428-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1428-141-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1428-140-0x0000000000B60000-0x0000000001C1A000-memory.dmp

Filesize
16.7MB

Download
memory/1428-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2576-15-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/2576-34-0x0000000000CF0000-0x0000000000CF2000-memory.dmp

Filesize
8KB

Download
memory/2576-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2576-14-0x0000000000CF0000-0x0000000000CF2000-memory.dmp

Filesize
8KB

Download
memory/2576-18-0x0000000000CF0000-0x0000000000CF2000-memory.dmp

Filesize
8KB

Download
memory/3616-38-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-13-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-10-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-36-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-37-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-28-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/3616-40-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-39-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-31-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-42-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-52-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-32-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/3616-27-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-35-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-26-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-17-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/3616-12-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-61-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-62-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-63-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-64-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-67-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-70-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-72-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-81-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/3616-92-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3616-75-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-8-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-11-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-9-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-6-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/3616-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download