Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 03:41
Static task
static1
Behavioral task
behavioral1
Sample
dba03af913c5ecbaee9b89aeb9de4d017cdd22b784604713711d3837d637236f.dll
Resource
win7-20240508-en
General
-
Target
dba03af913c5ecbaee9b89aeb9de4d017cdd22b784604713711d3837d637236f.dll
-
Size
120KB
-
MD5
6880a67ab5bb7d95e5bc5f2427213a8f
-
SHA1
ccef5f2822f8f659885d1df5c605b2599e8c3280
-
SHA256
dba03af913c5ecbaee9b89aeb9de4d017cdd22b784604713711d3837d637236f
-
SHA512
b235db86c2efe329a3f3e5dc64ac8d3f3aac873d9459a95eb5fb1ee03fd3c3d6e0c71c2cc0cc2cf487abfe3df0f9a6f77cfd4d57edabc6b82fc5cf2613554187
-
SSDEEP
3072:+DdzWPzXM2JPdRXUqdN1F3UytGYLRhPbWz/I:YdWL84l9GoRhR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
f76197a.exef763534.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76197a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76197a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763534.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763534.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763534.exe -
Processes:
f76197a.exef763534.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763534.exe -
Processes:
f763534.exef76197a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76197a.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 26 IoCs
Processes:
resource yara_rule behavioral1/memory/2088-15-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-18-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-14-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-19-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-20-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-21-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-22-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-16-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-23-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-17-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-62-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-61-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-63-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-64-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-65-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-67-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-80-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-82-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-84-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-102-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-103-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-104-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-106-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2088-143-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2112-164-0x0000000000950000-0x0000000001A0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2112-197-0x0000000000950000-0x0000000001A0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 31 IoCs
Processes:
resource yara_rule behavioral1/memory/2088-11-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2088-15-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-18-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-14-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-19-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-20-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-21-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-22-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-16-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-23-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2768-60-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2088-17-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-62-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-61-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-63-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-64-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-65-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-67-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-80-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-82-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-84-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-102-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-103-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-104-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-106-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-143-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2088-142-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2768-147-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2112-164-0x0000000000950000-0x0000000001A0A000-memory.dmp UPX behavioral1/memory/2112-197-0x0000000000950000-0x0000000001A0A000-memory.dmp UPX behavioral1/memory/2112-198-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f76197a.exef761ab2.exef763534.exepid process 2088 f76197a.exe 2768 f761ab2.exe 2112 f763534.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2088-15-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-18-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-14-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-19-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-20-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-21-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-22-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-16-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-23-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-17-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-62-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-61-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-63-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-64-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-65-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-67-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-80-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-82-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-84-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-102-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-103-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-104-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-106-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2088-143-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2112-164-0x0000000000950000-0x0000000001A0A000-memory.dmp upx behavioral1/memory/2112-197-0x0000000000950000-0x0000000001A0A000-memory.dmp upx -
Processes:
f76197a.exef763534.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76197a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763534.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763534.exe -
Processes:
f763534.exef76197a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763534.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76197a.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76197a.exef763534.exedescription ioc process File opened (read-only) \??\Q: f76197a.exe File opened (read-only) \??\G: f76197a.exe File opened (read-only) \??\K: f76197a.exe File opened (read-only) \??\M: f76197a.exe File opened (read-only) \??\N: f76197a.exe File opened (read-only) \??\R: f76197a.exe File opened (read-only) \??\I: f76197a.exe File opened (read-only) \??\J: f76197a.exe File opened (read-only) \??\O: f76197a.exe File opened (read-only) \??\P: f76197a.exe File opened (read-only) \??\E: f76197a.exe File opened (read-only) \??\H: f76197a.exe File opened (read-only) \??\E: f763534.exe File opened (read-only) \??\L: f76197a.exe File opened (read-only) \??\G: f763534.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76197a.exef763534.exedescription ioc process File created C:\Windows\f7619b8 f76197a.exe File opened for modification C:\Windows\SYSTEM.INI f76197a.exe File created C:\Windows\f7669ab f763534.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f76197a.exef763534.exepid process 2088 f76197a.exe 2088 f76197a.exe 2112 f763534.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f76197a.exef763534.exedescription pid process Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2088 f76197a.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe Token: SeDebugPrivilege 2112 f763534.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef76197a.exef763534.exedescription pid process target process PID 1928 wrote to memory of 2032 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2032 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2032 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2032 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2032 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2032 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2032 1928 rundll32.exe rundll32.exe PID 2032 wrote to memory of 2088 2032 rundll32.exe f76197a.exe PID 2032 wrote to memory of 2088 2032 rundll32.exe f76197a.exe PID 2032 wrote to memory of 2088 2032 rundll32.exe f76197a.exe PID 2032 wrote to memory of 2088 2032 rundll32.exe f76197a.exe PID 2088 wrote to memory of 1092 2088 f76197a.exe taskhost.exe PID 2088 wrote to memory of 1168 2088 f76197a.exe Dwm.exe PID 2088 wrote to memory of 1196 2088 f76197a.exe Explorer.EXE PID 2088 wrote to memory of 804 2088 f76197a.exe DllHost.exe PID 2088 wrote to memory of 1928 2088 f76197a.exe rundll32.exe PID 2088 wrote to memory of 2032 2088 f76197a.exe rundll32.exe PID 2088 wrote to memory of 2032 2088 f76197a.exe rundll32.exe PID 2032 wrote to memory of 2768 2032 rundll32.exe f761ab2.exe PID 2032 wrote to memory of 2768 2032 rundll32.exe f761ab2.exe PID 2032 wrote to memory of 2768 2032 rundll32.exe f761ab2.exe PID 2032 wrote to memory of 2768 2032 rundll32.exe f761ab2.exe PID 2032 wrote to memory of 2112 2032 rundll32.exe f763534.exe PID 2032 wrote to memory of 2112 2032 rundll32.exe f763534.exe PID 2032 wrote to memory of 2112 2032 rundll32.exe f763534.exe PID 2032 wrote to memory of 2112 2032 rundll32.exe f763534.exe PID 2088 wrote to memory of 1092 2088 f76197a.exe taskhost.exe PID 2088 wrote to memory of 1168 2088 f76197a.exe Dwm.exe PID 2088 wrote to memory of 1196 2088 f76197a.exe Explorer.EXE PID 2088 wrote to memory of 2768 2088 f76197a.exe f761ab2.exe PID 2088 wrote to memory of 2768 2088 f76197a.exe f761ab2.exe PID 2088 wrote to memory of 2112 2088 f76197a.exe f763534.exe PID 2088 wrote to memory of 2112 2088 f76197a.exe f763534.exe PID 2112 wrote to memory of 1092 2112 f763534.exe taskhost.exe PID 2112 wrote to memory of 1168 2112 f763534.exe Dwm.exe PID 2112 wrote to memory of 1196 2112 f763534.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f76197a.exef763534.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76197a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763534.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dba03af913c5ecbaee9b89aeb9de4d017cdd22b784604713711d3837d637236f.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dba03af913c5ecbaee9b89aeb9de4d017cdd22b784604713711d3837d637236f.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f76197a.exeC:\Users\Admin\AppData\Local\Temp\f76197a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f761ab2.exeC:\Users\Admin\AppData\Local\Temp\f761ab2.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f763534.exeC:\Users\Admin\AppData\Local\Temp\f763534.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5d0fdb9406aced5ed9ef7767c180f4a90
SHA136586ccb58481b924b7ffe60a77315eec03fa358
SHA25651ea16968e855dbc55565aee08b774f24f4b1780ad4cff973f075d8558e217b3
SHA5125ae99882d5d275b8a5a67b04b8d4cfe28723203f4f0f4bde7b75961a46c7300a95c1a25bf2565b00898a4402aae22e8b1ea9884012f2a9d3be674490f42d6385
-
\Users\Admin\AppData\Local\Temp\f76197a.exeFilesize
97KB
MD5d883c79d5d158270097407f3a27736a8
SHA1aa6a2dcdfecac50ca783cb09a8e69bce36f31ee5
SHA256bf8089541c92c92241a7c364ea46a1de748a1072b2c8ff1a27a64afa16a3225d
SHA512982e784a42fec5054cf3d75dfa2d937441b5b330f7bec749f4630a600f18c987eb4197a70dd1eca12485f75cb2d325ada51359dfb000cf4a96b163333407ad35
-
memory/1092-29-0x0000000002130000-0x0000000002132000-memory.dmpFilesize
8KB
-
memory/2032-45-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/2032-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2032-58-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/2032-36-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/2032-37-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/2032-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2032-75-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/2032-7-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2032-55-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/2032-57-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/2088-62-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-80-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-22-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-20-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-48-0x00000000005F0000-0x00000000005F2000-memory.dmpFilesize
8KB
-
memory/2088-46-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/2088-16-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-23-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2088-19-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-56-0x00000000005F0000-0x00000000005F2000-memory.dmpFilesize
8KB
-
memory/2088-14-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-17-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-18-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-61-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-63-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-64-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-65-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-67-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-141-0x00000000005F0000-0x00000000005F2000-memory.dmpFilesize
8KB
-
memory/2088-15-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-21-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-82-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-84-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-142-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2088-143-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-106-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-104-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-103-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2088-102-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2112-100-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2112-98-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2112-97-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2112-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2112-164-0x0000000000950000-0x0000000001A0A000-memory.dmpFilesize
16.7MB
-
memory/2112-197-0x0000000000950000-0x0000000001A0A000-memory.dmpFilesize
16.7MB
-
memory/2112-198-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2768-92-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2768-99-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2768-93-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2768-147-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2768-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB