sality | 6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c

Analysis

max time kernel
119s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Size

767KB
MD5

916dd306d5b551070a73339e870f3642
SHA1

935832a602ddc2f8688d9bce1b2ef86b6d72b487
SHA256

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c
SHA512

04ee1ec57c7fda5f0d51ef53e5d721f9edfef4d0d139e64eca314eaaf24756c403103d28831fdb9246040ac34347a6582165c53fe776602a9d7a161e5863ba0d
SSDEEP

12288:E1V4L4PCtGDtlLJgsGoT6gYAMkZ6XlwAcMs+50tgAakT7hs5fDDbbjmh8Q0u8sZD:E1VUQDtlLJg3or6XKAsCI8T92

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Downloads MZ/PE file

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2976-8-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-10-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-6-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-4-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-9-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-12-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-11-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-3-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-7-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-5-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-34-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-35-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-36-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-38-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-37-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx
behavioral1/memory/2976-40-0x0000000001EC0000-0x0000000002F7A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description ioc process

File opened (read-only) \??\E: 6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
File opened (read-only)	\??\E:	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Drops file in Windows directory 2 IoCs

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
File created	C:\Windows\f760f0e	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
File opened for modification	C:\Windows\SYSTEM.INI	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = a0d28922ccc9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80986d34ccc9da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425790020"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EC0A5A1-35BF-11EF-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060d073a4eec0c745b3565c9e962ff9e80000000002000000000010660000000100002000000078ebd1cd38de41d9dda949ff275d2219d440287615f31b861b3af88a8f5fa13f000000000e800000000200002000000090930b990547b7719d9c26eda3155db5361ef431255607c9971a778dce700d7b20000000bb12c23e093994fc4ead37f4b21b8d8f46c7565078f3ef86fa4675458064e14740000000c3867e87ba6f99f1b313af81e0f9108be3ff38b4d1cb8465eb86b955a286a34e15a7e30168bc72d836741ffbfa1d04329853072fe908d09fe36b52f4f6797cbb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060d073a4eec0c745b3565c9e962ff9e800000000020000000000106600000001000020000000dec954314e730d7461760f082291ac32b63d7f33aeeffac598717d509f215647000000000e8000000002000020000000142417e2a34e2db1ae03e5c26064defae43480b87d3bf3e4b9b0a5800d5f0fd490000000f2d3ceadd27f895cdfbd8d6ac1f284f0956242015d6faab77e5614aea0f3d49658f2b6e946aa0a71d7bb055c2e66835bdf4b765835cd648b560098743bb4355cc02d9364cfaf032db0bc1810183c07233e7e6d7ad2d803502f1f28a7d541942e033f88ccda7a4590337169248c8304b2b8728e8c3c9e7a8d7154e955c45684e32f847000e80f28d5724f1d2cfca9f794400000009c5bd1ad19d764364b97cc0ff36fb6471189d7053c6758b2b8dd8b8c78763b3e67814f1843511065c5fc509b3dbcc14a4c93437d7c462218a6da05cb78d9aa93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

pid process

2976 6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

pid	process
2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	pid	process
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
Token: SeDebugPrivilege	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2680 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2680 iexplore.exe
2680 iexplore.exe
1996 IEXPLORE.EXE
1996 IEXPLORE.EXE

pid	process
2680	iexplore.exe

pid	process
2680	iexplore.exe
2680	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exeiexplore.exe

description	pid	process	target process
PID 2976 wrote to memory of 1120	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	taskhost.exe
PID 2976 wrote to memory of 1172	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	Dwm.exe
PID 2976 wrote to memory of 1212	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	Explorer.EXE
PID 2976 wrote to memory of 320	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	DllHost.exe
PID 2976 wrote to memory of 2680	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	iexplore.exe
PID 2976 wrote to memory of 2680	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	iexplore.exe
PID 2976 wrote to memory of 2680	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	iexplore.exe
PID 2976 wrote to memory of 2680	2976	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe	iexplore.exe
PID 2680 wrote to memory of 1996	2680	iexplore.exe	IEXPLORE.EXE
PID 2680 wrote to memory of 1996	2680	iexplore.exe	IEXPLORE.EXE
PID 2680 wrote to memory of 1996	2680	iexplore.exe	IEXPLORE.EXE
PID 2680 wrote to memory of 1996	2680	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe
"C:\Users\Admin\AppData\Local\Temp\6234ee603e913259b81db21f73ab91ed8344e294f34bdfca4ece19cb67332e9c.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2976

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://down.360safe.com/setupbeta.exe
3⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:320

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8e880a498591d1bebea0ba59c1d20762

SHA1
c2181c6814a58be21551d809f987a80f9de61b72

SHA256
f86c8db857105504fdf6e49c66bcbbc587e9a273354166473e3ec8b41c687385

SHA512
35266cd5a33ac91f59336cadb17af01a35e4d73079dd872919ab10d52a7928b4879ad6aa360bc15fd5732d7a0cbf0cede9640411a95bb47176eb873b665fc221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a89f622f54fbb71e4ea3fccdf7def266

SHA1
7f2effabb6b900ce88c4963b64c077c566b655e1

SHA256
37f3ae524c6428d8c10136a04ba255b151e4ded6c34856d6f7c8efc04d6deacc

SHA512
a3fe52f95081d583c60f464b11e9681cdbce83db896d8ba7358a7910578a36408d78a98fe39dfed51258084478178bc6d9baeab233143893ade4727d1965bbe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f871556f9d3c38ef4502aacce515c754

SHA1
8bdb7917aaf0e84807a69e2ae727c33045a48a9b

SHA256
c501fb9ddfe6eb1bb66255762672dde5b957cd847fd4b04fc57a80d6e6a05a90

SHA512
abdccc5efc649ce8f5c01c8c1f5eb548f7067bf95d3a600d28e0f5d7589a664070da5abfa831663420dc3c9bfb3fa3071133de73f2f4130fe9ebd9937248cc1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c06080d97f080bd1fd36267eaa6af5e3

SHA1
db9e8600557a7ddab7652c5e2a2466054df9e682

SHA256
5bdf0368fe17415c27bbffa485d847ebb35d4b04a4a3eda2504bb590377a52fb

SHA512
f4693fe3151f5177ba111b3cb57ff98b98f430e9f9043c3f186a389d3d6dc5c0beafef506dad9f2fc71f936770ba4425d04ffc6a56c810d03af3fd7ccc8b73dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
6a3eab57e9a9d673a3612614bd017fea

SHA1
d188941f5bab08f7625531546fa90f481e2cff95

SHA256
92935c0ac344fd6e174be8d7d3a21be906a1e4c2bf7425cdce03b4f6555df6af

SHA512
b7f6be4e4c6b627cd61546a98116c87cb5255a3d72923f981ad4fe2d429762de7a0331a9c02599c49dce4714992b0bb3a85e4341d917ba4bec08ecd3de6da2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
6be343a89a787acc7f5ba3c0925e79b7

SHA1
16c5be9a310870ac8dc0662e96e0c4bc1e6a87aa

SHA256
ec1a66fbefa62c0afa135488c52209e3d15c31fde9a42f7f7f6f045d384a2142

SHA512
78c0e3ab4e4151bfd058977f014c0f96b8bb29413a7e97a9f929020d56eedf8bacf2741a83b45730e80ea22806eacfa32a1f9af6331dc96655d69483032d28ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
21827158054f01efa832e0fc2d47ee6f

SHA1
97dc8ff284fe3802793a72db167d6dbeb2fb6776

SHA256
89a877d0e8a71cea083f3eca05061b7ce65bcae6e4b7458995a31b80964474f9

SHA512
7077b710674a211cbe76dc97a6a8e33c0b466ef81b4152c82be56100b59204b57bf5cdf432eb26c8f33bc1466fb6ce88d2c7273c800e19da95e51ab48e6929bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
508148608b1903a249f7d99d575cf919

SHA1
b8224b4cdf29ea744c2b8d5bb129d9569f52480c

SHA256
be43e854c8ec56fb5d4186973d424dd1231d2e3495b15975b7d902c318f9eede

SHA512
0e5b4b5c71a31c99eea1ab6285dce7d0978d118639a23662c0c8192aca8aed02b605337a7fd6823ff908e77d8bec79436b595092c29f71dd6d81f03028c9ba44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1eed01db08cbbc1a6a45eb12960e3cf0

SHA1
427c552556c0e40489847aa0982b6d02cb08a37b

SHA256
7626f3dc04ec42bb3eaaea8da7cfd7d1eb9419cedede909bde5584fcbcc5a13e

SHA512
c960de656dc1742c476ccede05cdddc33d4021aa8f1207de505ea3b046f2ba48f588416f764aa4d0545e91c849a43425867d6394b0dba1ac6a8120d8564baa65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5add7f0cb472462cb9c3a4db7885267c

SHA1
1b5aa13186759cb8cc4f35ee5603eca12dc23ce7

SHA256
676c75140a30ec238c166e415a3f45aa63d7d65055248fc238f53256761c3983

SHA512
920238991897c1b7f3c62a383a615f1b14a1103c6e5a97a4a542b4b0577933ff653d08e73265a0c9ec4d7dcd23d91d1f16c0006f2dd3f27314c46091bccb1208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
415243f9a83b055df3bc03e620a8d008

SHA1
617b2b53d8affdb5121577f405a45cd1ebba7aea

SHA256
1de16fdf2ef4110ba0da8c19e192869126280225c727d779fa0bf23f459ba1b3

SHA512
07e76d1dac0cfdce1189b16adfc5aa5b34d39832e9de374af4edb717884fd612f3d1619bd947f6ea7e2c3e2f2adc0178cd0847c956be3d5af36acfe7ef469a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
11f6e8d2ee40f10fa320f351736b9021

SHA1
fdccc113e342d5b5ec6191be481ece4deddaf697

SHA256
74e38db031e71a1756a24300b2ccff6692ac119eb7da742efd7393487868eb00

SHA512
ea46833f726f25c0eb1b99a52ba17ffd30f7800b61735d4d35c39bd8e44c88b4b8e10deaa70a5c6d1c01691fd693c2f3d2c0505af20b924a0156ba0d6dbf3edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2dde4e45ed118fc2f5e5650e33627665

SHA1
8f33e2775d23281cff66a63f87e1b99c0f9ae89d

SHA256
7e9ce1b83d475cbefd628bea1fc5d7e289fb675b0db3934e0a5d8065276f4552

SHA512
8c7e9c81532c466aeef559f764d44cbe8f37e8f116b1dd96f49a33b6bf763a917b1b772133e8bdf87b76e11ad0f7fe938e9cf6f5ad0e5a0b4dbfc5e1af07d16b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4931.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A21.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A72.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1120-18-0x0000000000620000-0x0000000000622000-memory.dmp

Filesize
8KB

Download
memory/2976-28-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2976-11-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-36-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-38-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-37-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-40-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-56-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2976-34-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-5-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-7-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-3-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-35-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-27-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2976-0-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2976-33-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2976-31-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2976-32-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2976-12-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-9-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-4-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-6-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-10-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download
memory/2976-8-0x0000000001EC0000-0x0000000002F7A000-memory.dmp

Filesize
16.7MB

Download