sality | aecc096b157acdf4f6d4278317168acf7fbb4d3fababb148cabd67aaaf80e7e6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aecc096b157acdf4f6d4278317168acf7fbb4d3fababb148cabd67aaaf80e7e6.dll
Size

120KB
MD5

69dec5442bf77ab9ee72fd2671f64c87
SHA1

8b3b492d901dcf9a991a7b2a34bebcc86ffce08e
SHA256

aecc096b157acdf4f6d4278317168acf7fbb4d3fababb148cabd67aaaf80e7e6
SHA512

26b65b052fdd17c0e7b64c655167f2a03ef28caad5376411e58edfdaf26f00a72d8456826a1df7c303c3b3ca98eff3366e95357be25a2030e25da65c453346fe
SSDEEP

1536:9lGOqS1noZvaG+ExMunnjPYWf80J8N6U0V8fEqFBEqMnzkrKLiO:9lGOqewvahQjjPY4itCq8L

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f761ee6.exef763a81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f763a81.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761ee6.exef763a81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763a81.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761ee6.exef763a81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763a81.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2064-16-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-20-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-18-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-21-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-24-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-26-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-25-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-22-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-23-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-19-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-65-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-66-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-67-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-68-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-69-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-71-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-72-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-87-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-90-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-91-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-108-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-111-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2064-152-0x00000000006C0000-0x000000000177A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2616-171-0x0000000000930000-0x00000000019EA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2616-208-0x0000000000930000-0x00000000019EA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 29 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2064-16-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-20-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-18-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-21-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-24-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-26-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-25-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2564-64-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2064-22-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-23-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-19-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-65-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-66-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-67-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-68-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-69-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-71-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-72-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-87-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-90-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-91-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-108-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-111-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2064-153-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2064-152-0x00000000006C0000-0x000000000177A000-memory.dmp	UPX
behavioral1/memory/2564-157-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2616-171-0x0000000000930000-0x00000000019EA000-memory.dmp	UPX
behavioral1/memory/2616-208-0x0000000000930000-0x00000000019EA000-memory.dmp	UPX
behavioral1/memory/2616-207-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

f761ee6.exef76207c.exef763a81.exe

pid process

2064 f761ee6.exe
2564 f76207c.exe
2616 f763a81.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2444 rundll32.exe
2444 rundll32.exe
2444 rundll32.exe
2444 rundll32.exe
2444 rundll32.exe
2444 rundll32.exe

pid	process
2064	f761ee6.exe
2564	f76207c.exe
2616	f763a81.exe

pid	process
2444	rundll32.exe
2444	rundll32.exe
2444	rundll32.exe
2444	rundll32.exe
2444	rundll32.exe
2444	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2064-16-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-20-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-18-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-21-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-24-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-26-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-25-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-22-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-23-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-19-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-65-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-66-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-67-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-68-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-69-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-71-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-72-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-87-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-90-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-91-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-108-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-111-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2064-152-0x00000000006C0000-0x000000000177A000-memory.dmp	upx
behavioral1/memory/2616-171-0x0000000000930000-0x00000000019EA000-memory.dmp	upx
behavioral1/memory/2616-208-0x0000000000930000-0x00000000019EA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761ee6.exef763a81.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f763a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763a81.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f761ee6.exef763a81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763a81.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f763a81.exef761ee6.exe

description	ioc	process
File opened (read-only)	\??\G:	f763a81.exe
File opened (read-only)	\??\G:	f761ee6.exe
File opened (read-only)	\??\J:	f761ee6.exe
File opened (read-only)	\??\O:	f761ee6.exe
File opened (read-only)	\??\R:	f761ee6.exe
File opened (read-only)	\??\T:	f761ee6.exe
File opened (read-only)	\??\H:	f761ee6.exe
File opened (read-only)	\??\I:	f761ee6.exe
File opened (read-only)	\??\L:	f761ee6.exe
File opened (read-only)	\??\M:	f761ee6.exe
File opened (read-only)	\??\E:	f761ee6.exe
File opened (read-only)	\??\K:	f761ee6.exe
File opened (read-only)	\??\P:	f761ee6.exe
File opened (read-only)	\??\Q:	f761ee6.exe
File opened (read-only)	\??\N:	f761ee6.exe
File opened (read-only)	\??\S:	f761ee6.exe
File opened (read-only)	\??\E:	f763a81.exe

Drops file in Windows directory 3 IoCs

Processes:

f761ee6.exef763a81.exe

description ioc process

File created C:\Windows\f761f63 f761ee6.exe
File opened for modification C:\Windows\SYSTEM.INI f761ee6.exe
File created C:\Windows\f766f75 f763a81.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f761ee6.exef763a81.exe

pid process

2064 f761ee6.exe
2064 f761ee6.exe
2616 f763a81.exe

description	ioc	process
File created	C:\Windows\f761f63	f761ee6.exe
File opened for modification	C:\Windows\SYSTEM.INI	f761ee6.exe
File created	C:\Windows\f766f75	f763a81.exe

pid	process
2064	f761ee6.exe
2064	f761ee6.exe
2616	f763a81.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f761ee6.exef763a81.exe

description	pid	process
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2064	f761ee6.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe
Token: SeDebugPrivilege	2616	f763a81.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef761ee6.exef763a81.exe

description	pid	process	target process
PID 2424 wrote to memory of 2444	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2444	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2444	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2444	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2444	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2444	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2444	2424	rundll32.exe	rundll32.exe
PID 2444 wrote to memory of 2064	2444	rundll32.exe	f761ee6.exe
PID 2444 wrote to memory of 2064	2444	rundll32.exe	f761ee6.exe
PID 2444 wrote to memory of 2064	2444	rundll32.exe	f761ee6.exe
PID 2444 wrote to memory of 2064	2444	rundll32.exe	f761ee6.exe
PID 2064 wrote to memory of 1100	2064	f761ee6.exe	taskhost.exe
PID 2064 wrote to memory of 1160	2064	f761ee6.exe	Dwm.exe
PID 2064 wrote to memory of 1188	2064	f761ee6.exe	Explorer.EXE
PID 2064 wrote to memory of 1912	2064	f761ee6.exe	DllHost.exe
PID 2064 wrote to memory of 2424	2064	f761ee6.exe	rundll32.exe
PID 2064 wrote to memory of 2444	2064	f761ee6.exe	rundll32.exe
PID 2064 wrote to memory of 2444	2064	f761ee6.exe	rundll32.exe
PID 2444 wrote to memory of 2564	2444	rundll32.exe	f76207c.exe
PID 2444 wrote to memory of 2564	2444	rundll32.exe	f76207c.exe
PID 2444 wrote to memory of 2564	2444	rundll32.exe	f76207c.exe
PID 2444 wrote to memory of 2564	2444	rundll32.exe	f76207c.exe
PID 2444 wrote to memory of 2616	2444	rundll32.exe	f763a81.exe
PID 2444 wrote to memory of 2616	2444	rundll32.exe	f763a81.exe
PID 2444 wrote to memory of 2616	2444	rundll32.exe	f763a81.exe
PID 2444 wrote to memory of 2616	2444	rundll32.exe	f763a81.exe
PID 2064 wrote to memory of 1100	2064	f761ee6.exe	taskhost.exe
PID 2064 wrote to memory of 1160	2064	f761ee6.exe	Dwm.exe
PID 2064 wrote to memory of 1188	2064	f761ee6.exe	Explorer.EXE
PID 2064 wrote to memory of 2564	2064	f761ee6.exe	f76207c.exe
PID 2064 wrote to memory of 2564	2064	f761ee6.exe	f76207c.exe
PID 2064 wrote to memory of 2616	2064	f761ee6.exe	f763a81.exe
PID 2064 wrote to memory of 2616	2064	f761ee6.exe	f763a81.exe
PID 2616 wrote to memory of 1100	2616	f763a81.exe	taskhost.exe
PID 2616 wrote to memory of 1160	2616	f763a81.exe	Dwm.exe
PID 2616 wrote to memory of 1188	2616	f763a81.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f761ee6.exef763a81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761ee6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763a81.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1100

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aecc096b157acdf4f6d4278317168acf7fbb4d3fababb148cabd67aaaf80e7e6.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aecc096b157acdf4f6d4278317168acf7fbb4d3fababb148cabd67aaaf80e7e6.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444

C:\Users\Admin\AppData\Local\Temp\f761ee6.exe
C:\Users\Admin\AppData\Local\Temp\f761ee6.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2064

C:\Users\Admin\AppData\Local\Temp\f76207c.exe
C:\Users\Admin\AppData\Local\Temp\f76207c.exe
4⤵
- Executes dropped EXE
PID:2564

C:\Users\Admin\AppData\Local\Temp\f763a81.exe
C:\Users\Admin\AppData\Local\Temp\f763a81.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2616

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1912

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f761ee6.exe
Filesize
97KB

MD5
c321b9c9707d471dee90ebf34ea9ae84

SHA1
b94b3d84b2c9f9abdc5aee88b98a1f9e47f68bd5

SHA256
adc6bafae5925c549ee259292c14e1e7bef4fa016a81c723284b3d60b1efeedd

SHA512
3764bfc61ec98fb9422747c0039c84f5f9dde3f65ee47e676fafefbd6b025cc715da94f6d0655c66e0501996cae8756f74614aeb7deb7cc2de7186930134d31b

Download Submit
C:\Windows\SYSTEM.INI
Filesize
256B

MD5
bc09254578b181a8d183d6b2516e81f2

SHA1
934b234d0d0103e1146ff58d077b7ec61f0470a6

SHA256
f2f7eb4decd73f79dd5688406ba761e836c20b8730c38b0b110e9b00dcf97fbd

SHA512
6a7e3376911dd7ddc8cd6f4770713f4b9e0050a3b79c218e06674a1f9ca6e217e580a63024f3deb8f648cf6c6102fecbfdc7e5249c09f9432e64cc35ab4afb7c

Download Submit
memory/1100-32-0x0000000002070000-0x0000000002072000-memory.dmp

Filesize
8KB

Download
memory/2064-19-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-18-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-66-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2064-21-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-24-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-26-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-52-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/2064-50-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2064-152-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-153-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2064-111-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-108-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-87-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-25-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-91-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-90-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-67-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-61-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/2064-72-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-71-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-20-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-65-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-69-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-23-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-16-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-22-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2064-68-0x00000000006C0000-0x000000000177A000-memory.dmp

Filesize
16.7MB

Download
memory/2444-49-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2444-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2444-59-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2444-39-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2444-40-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2444-85-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/2444-84-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2444-81-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2444-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2444-62-0x00000000002E0000-0x00000000002F2000-memory.dmp

Filesize
72KB

Download
memory/2444-63-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2444-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2444-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2444-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2444-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2564-109-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2564-101-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2564-100-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2564-157-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2564-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2616-110-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2616-171-0x0000000000930000-0x00000000019EA000-memory.dmp

Filesize
16.7MB

Download
memory/2616-106-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2616-107-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2616-86-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2616-208-0x0000000000930000-0x00000000019EA000-memory.dmp

Filesize
16.7MB

Download
memory/2616-207-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads