sality | a642406892cb7286c77632961e29e7c9cd7db8d8c89c6e1b110a683f3ccc42d4

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a642406892cb7286c77632961e29e7c9cd7db8d8c89c6e1b110a683f3ccc42d4.dll
Size

120KB
MD5

14e42fe806e3089b262e018d9c40807c
SHA1

d260da84c61bd8d50aa5ca151bf3d504077ebe68
SHA256

a642406892cb7286c77632961e29e7c9cd7db8d8c89c6e1b110a683f3ccc42d4
SHA512

4a21b1c585f0f5b104d271c1e9cb6736caf32426cf5f55586c8fb5bd36464a7cb7255e1e12637540e2c8352f366a5c6f134d54393becded3a1b837c1c0819ae8
SSDEEP

3072:VVJQiKXII1L42DL7ZASApJMWOpzaVIWUWGkTky:VVJodHFASApJMWO1mbGw

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7622cc.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7622cc.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7622cc.exef760703.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760703.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1520-16-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-14-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-15-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-19-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-21-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-20-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-17-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-18-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-22-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-23-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-62-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-63-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-64-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-66-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-65-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-81-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-82-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-83-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-85-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-104-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-106-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-107-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-151-0x0000000000660000-0x000000000171A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2728-168-0x0000000000A60000-0x0000000001B1A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2728-205-0x0000000000A60000-0x0000000001B1A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 29 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1520-16-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-14-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-15-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-19-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-21-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-20-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-17-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-18-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1956-61-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/1520-22-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-23-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-62-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-63-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-64-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-66-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-65-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-81-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-82-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-83-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-85-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-104-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-106-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-107-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-151-0x0000000000660000-0x000000000171A000-memory.dmp	UPX
behavioral1/memory/1520-150-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/1956-155-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2728-168-0x0000000000A60000-0x0000000001B1A000-memory.dmp	UPX
behavioral1/memory/2728-205-0x0000000000A60000-0x0000000001B1A000-memory.dmp	UPX
behavioral1/memory/2728-206-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

f760703.exef7608a8.exef7622cc.exe

pid process

1520 f760703.exe
1956 f7608a8.exe
2728 f7622cc.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

1592 rundll32.exe
1592 rundll32.exe
1592 rundll32.exe
1592 rundll32.exe
1592 rundll32.exe
1592 rundll32.exe

pid	process
1520	f760703.exe
1956	f7608a8.exe
2728	f7622cc.exe

pid	process
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1520-16-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-14-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-15-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-19-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-21-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-20-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-17-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-18-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-22-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-23-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-62-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-63-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-64-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-66-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-65-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-81-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-82-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-83-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-85-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-104-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-106-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-107-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/1520-151-0x0000000000660000-0x000000000171A000-memory.dmp	upx
behavioral1/memory/2728-168-0x0000000000A60000-0x0000000001B1A000-memory.dmp	upx
behavioral1/memory/2728-205-0x0000000000A60000-0x0000000001B1A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760703.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7622cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760703.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7622cc.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f760703.exef7622cc.exe

description	ioc	process
File opened (read-only)	\??\P:	f760703.exe
File opened (read-only)	\??\E:	f7622cc.exe
File opened (read-only)	\??\H:	f760703.exe
File opened (read-only)	\??\I:	f760703.exe
File opened (read-only)	\??\O:	f760703.exe
File opened (read-only)	\??\G:	f7622cc.exe
File opened (read-only)	\??\G:	f760703.exe
File opened (read-only)	\??\M:	f760703.exe
File opened (read-only)	\??\Q:	f760703.exe
File opened (read-only)	\??\L:	f760703.exe
File opened (read-only)	\??\N:	f760703.exe
File opened (read-only)	\??\R:	f760703.exe
File opened (read-only)	\??\E:	f760703.exe
File opened (read-only)	\??\J:	f760703.exe
File opened (read-only)	\??\K:	f760703.exe

Drops file in Windows directory 3 IoCs

Processes:

f760703.exef7622cc.exe

description ioc process

File created C:\Windows\f760770 f760703.exe
File opened for modification C:\Windows\SYSTEM.INI f760703.exe
File created C:\Windows\f76581e f7622cc.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f760703.exef7622cc.exe

pid process

1520 f760703.exe
1520 f760703.exe
2728 f7622cc.exe

description	ioc	process
File created	C:\Windows\f760770	f760703.exe
File opened for modification	C:\Windows\SYSTEM.INI	f760703.exe
File created	C:\Windows\f76581e	f7622cc.exe

pid	process
1520	f760703.exe
1520	f760703.exe
2728	f7622cc.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f760703.exef7622cc.exe

description	pid	process
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	1520	f760703.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe
Token: SeDebugPrivilege	2728	f7622cc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef760703.exef7622cc.exe

description	pid	process	target process
PID 1540 wrote to memory of 1592	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1592	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1592	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1592	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1592	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1592	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1592	1540	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1520	1592	rundll32.exe	f760703.exe
PID 1592 wrote to memory of 1520	1592	rundll32.exe	f760703.exe
PID 1592 wrote to memory of 1520	1592	rundll32.exe	f760703.exe
PID 1592 wrote to memory of 1520	1592	rundll32.exe	f760703.exe
PID 1520 wrote to memory of 1232	1520	f760703.exe	taskhost.exe
PID 1520 wrote to memory of 1312	1520	f760703.exe	Dwm.exe
PID 1520 wrote to memory of 1348	1520	f760703.exe	Explorer.EXE
PID 1520 wrote to memory of 1652	1520	f760703.exe	DllHost.exe
PID 1520 wrote to memory of 1540	1520	f760703.exe	rundll32.exe
PID 1520 wrote to memory of 1592	1520	f760703.exe	rundll32.exe
PID 1520 wrote to memory of 1592	1520	f760703.exe	rundll32.exe
PID 1592 wrote to memory of 1956	1592	rundll32.exe	f7608a8.exe
PID 1592 wrote to memory of 1956	1592	rundll32.exe	f7608a8.exe
PID 1592 wrote to memory of 1956	1592	rundll32.exe	f7608a8.exe
PID 1592 wrote to memory of 1956	1592	rundll32.exe	f7608a8.exe
PID 1592 wrote to memory of 2728	1592	rundll32.exe	f7622cc.exe
PID 1592 wrote to memory of 2728	1592	rundll32.exe	f7622cc.exe
PID 1592 wrote to memory of 2728	1592	rundll32.exe	f7622cc.exe
PID 1592 wrote to memory of 2728	1592	rundll32.exe	f7622cc.exe
PID 1520 wrote to memory of 1232	1520	f760703.exe	taskhost.exe
PID 1520 wrote to memory of 1312	1520	f760703.exe	Dwm.exe
PID 1520 wrote to memory of 1348	1520	f760703.exe	Explorer.EXE
PID 1520 wrote to memory of 1956	1520	f760703.exe	f7608a8.exe
PID 1520 wrote to memory of 1956	1520	f760703.exe	f7608a8.exe
PID 1520 wrote to memory of 2728	1520	f760703.exe	f7622cc.exe
PID 1520 wrote to memory of 2728	1520	f760703.exe	f7622cc.exe
PID 2728 wrote to memory of 1232	2728	f7622cc.exe	taskhost.exe
PID 2728 wrote to memory of 1312	2728	f7622cc.exe	Dwm.exe
PID 2728 wrote to memory of 1348	2728	f7622cc.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7622cc.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1232

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1312

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1348

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a642406892cb7286c77632961e29e7c9cd7db8d8c89c6e1b110a683f3ccc42d4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a642406892cb7286c77632961e29e7c9cd7db8d8c89c6e1b110a683f3ccc42d4.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\f760703.exe
C:\Users\Admin\AppData\Local\Temp\f760703.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1520

C:\Users\Admin\AppData\Local\Temp\f7608a8.exe
C:\Users\Admin\AppData\Local\Temp\f7608a8.exe
4⤵
- Executes dropped EXE
PID:1956

C:\Users\Admin\AppData\Local\Temp\f7622cc.exe
C:\Users\Admin\AppData\Local\Temp\f7622cc.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2728

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1652

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
c624dbf83b6885257ab902cd3632a853

SHA1
828ce7241d87ff201c09f4ad3b8bb2f2a89757b2

SHA256
1854f8c78d88881bc86a9c2d00d689c662c9f04c99142009f54de6072d48ab31

SHA512
8750a3bb08845f2d123e9da01196e09af55fb784e618fb281218b8da15f3589eb3ef79200105a73ecb780ea6e25dfb2dfb8b7adebee1974736f1d4c88dd936bd

Download Submit
\Users\Admin\AppData\Local\Temp\f760703.exe
Filesize
97KB

MD5
8a845a2b0073d119d09caccc25aa0251

SHA1
c1027f9317939362a9eda42c59d8b10df80bf2f9

SHA256
54df1b970b8d71465ffa34aa5b4f8a9846d90cf55b9466d47427ab1eb5c1c2d8

SHA512
0905a069a692a57822b3266412f320c96781371cf63b5756178eb174bcec27599592421cb59c9f74e0a542cd2e070d16542a222f3bfb1e8623099d073252709c

Download Submit
memory/1232-29-0x00000000003A0000-0x00000000003A2000-memory.dmp

Filesize
8KB

Download
memory/1520-63-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-150-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1520-16-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-14-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-15-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-19-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-66-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-20-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-17-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-18-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-48-0x0000000001860000-0x0000000001861000-memory.dmp

Filesize
4KB

Download
memory/1520-65-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-50-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1520-81-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-151-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-127-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1520-107-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-106-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-64-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1520-22-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-23-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-62-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-104-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-85-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-21-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-83-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-82-0x0000000000660000-0x000000000171A000-memory.dmp

Filesize
16.7MB

Download
memory/1592-37-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/1592-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1592-76-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/1592-79-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1592-57-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/1592-8-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/1592-9-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/1592-60-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/1592-59-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/1592-47-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1592-38-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1956-94-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1956-96-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1956-101-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1956-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-155-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2728-103-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2728-100-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2728-102-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2728-80-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2728-168-0x0000000000A60000-0x0000000001B1A000-memory.dmp

Filesize
16.7MB

Download
memory/2728-205-0x0000000000A60000-0x0000000001B1A000-memory.dmp

Filesize
16.7MB

Download
memory/2728-206-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads