sality | e9f3315d8f65e8dad8f5a34b32f440b9f205520c9c371a46d2ff541127ce3350

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9f3315d8f65e8dad8f5a34b32f440b9f205520c9c371a46d2ff541127ce3350.dll
Size

120KB
MD5

5c2b82c35bf0107906481ed30a692616
SHA1

2df564623bec44c5c2d091f981127e1d5a403fe9
SHA256

e9f3315d8f65e8dad8f5a34b32f440b9f205520c9c371a46d2ff541127ce3350
SHA512

c1bf0bc394b83c4748562bf82a66132f22aeed91a7f7c1934fbf7cb8e12ee007ada1f60844bb04a2ffccff7989088b601cfdc8c93dc3c642dc7ad483b4761977
SSDEEP

3072:8Xv7mG6YrfdHoOsPxMjE0J9uIIgU78Z+gtCq:8Xi9AptcxMjE0t08kaCq

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f76195a.exef7617c5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7617c5.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7617c5.exef76195a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f76195a.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7617c5.exef76195a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7617c5.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2864-15-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-18-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-22-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-14-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-20-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-21-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-23-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-19-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-17-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-16-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-60-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-61-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-62-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-63-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-64-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-66-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-80-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-81-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-83-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-85-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-105-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-115-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2864-148-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2648-160-0x0000000000970000-0x0000000001A2A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2648-182-0x0000000000970000-0x0000000001A2A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 29 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2864-15-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-18-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-22-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-14-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-20-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-21-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-23-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-19-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-17-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-16-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2648-59-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2864-60-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-61-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-62-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-63-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-64-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-66-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-80-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-81-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-83-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-85-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-105-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-115-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2864-147-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2864-148-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2648-160-0x0000000000970000-0x0000000001A2A000-memory.dmp	UPX
behavioral1/memory/2648-182-0x0000000000970000-0x0000000001A2A000-memory.dmp	UPX
behavioral1/memory/2648-181-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2468-186-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

f7617c5.exef76195a.exef76339e.exe

pid process

2864 f7617c5.exe
2648 f76195a.exe
2468 f76339e.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2844 rundll32.exe
2844 rundll32.exe
2844 rundll32.exe
2844 rundll32.exe
2844 rundll32.exe
2844 rundll32.exe

pid	process
2864	f7617c5.exe
2648	f76195a.exe
2468	f76339e.exe

pid	process
2844	rundll32.exe
2844	rundll32.exe
2844	rundll32.exe
2844	rundll32.exe
2844	rundll32.exe
2844	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2864-15-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-18-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-22-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-14-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-20-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-21-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-23-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-19-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-17-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-16-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-60-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-61-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-62-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-63-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-64-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-66-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-80-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-81-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-83-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-85-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-105-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-115-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2864-148-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2648-160-0x0000000000970000-0x0000000001A2A000-memory.dmp	upx
behavioral1/memory/2648-182-0x0000000000970000-0x0000000001A2A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7617c5.exef76195a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7617c5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f76195a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7617c5.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f7617c5.exef76195a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f76195a.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f7617c5.exe

description	ioc	process
File opened (read-only)	\??\N:	f7617c5.exe
File opened (read-only)	\??\S:	f7617c5.exe
File opened (read-only)	\??\E:	f7617c5.exe
File opened (read-only)	\??\G:	f7617c5.exe
File opened (read-only)	\??\I:	f7617c5.exe
File opened (read-only)	\??\K:	f7617c5.exe
File opened (read-only)	\??\M:	f7617c5.exe
File opened (read-only)	\??\P:	f7617c5.exe
File opened (read-only)	\??\O:	f7617c5.exe
File opened (read-only)	\??\H:	f7617c5.exe
File opened (read-only)	\??\J:	f7617c5.exe
File opened (read-only)	\??\L:	f7617c5.exe
File opened (read-only)	\??\Q:	f7617c5.exe
File opened (read-only)	\??\R:	f7617c5.exe

Drops file in Windows directory 3 IoCs

Processes:

f7617c5.exef76195a.exe

description ioc process

File created C:\Windows\f761822 f7617c5.exe
File opened for modification C:\Windows\SYSTEM.INI f7617c5.exe
File created C:\Windows\f766883 f76195a.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f7617c5.exef76195a.exe

pid process

2864 f7617c5.exe
2864 f7617c5.exe
2648 f76195a.exe

description	ioc	process
File created	C:\Windows\f761822	f7617c5.exe
File opened for modification	C:\Windows\SYSTEM.INI	f7617c5.exe
File created	C:\Windows\f766883	f76195a.exe

pid	process
2864	f7617c5.exe
2864	f7617c5.exe
2648	f76195a.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f7617c5.exef76195a.exe

description	pid	process
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2864	f7617c5.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe
Token: SeDebugPrivilege	2648	f76195a.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef7617c5.exef76195a.exe

description	pid	process	target process
PID 1208 wrote to memory of 2844	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 2844	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 2844	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 2844	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 2844	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 2844	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 2844	1208	rundll32.exe	rundll32.exe
PID 2844 wrote to memory of 2864	2844	rundll32.exe	f7617c5.exe
PID 2844 wrote to memory of 2864	2844	rundll32.exe	f7617c5.exe
PID 2844 wrote to memory of 2864	2844	rundll32.exe	f7617c5.exe
PID 2844 wrote to memory of 2864	2844	rundll32.exe	f7617c5.exe
PID 2864 wrote to memory of 1116	2864	f7617c5.exe	taskhost.exe
PID 2864 wrote to memory of 1168	2864	f7617c5.exe	Dwm.exe
PID 2864 wrote to memory of 1232	2864	f7617c5.exe	Explorer.EXE
PID 2864 wrote to memory of 2176	2864	f7617c5.exe	DllHost.exe
PID 2864 wrote to memory of 1208	2864	f7617c5.exe	rundll32.exe
PID 2864 wrote to memory of 2844	2864	f7617c5.exe	rundll32.exe
PID 2864 wrote to memory of 2844	2864	f7617c5.exe	rundll32.exe
PID 2844 wrote to memory of 2648	2844	rundll32.exe	f76195a.exe
PID 2844 wrote to memory of 2648	2844	rundll32.exe	f76195a.exe
PID 2844 wrote to memory of 2648	2844	rundll32.exe	f76195a.exe
PID 2844 wrote to memory of 2648	2844	rundll32.exe	f76195a.exe
PID 2844 wrote to memory of 2468	2844	rundll32.exe	f76339e.exe
PID 2844 wrote to memory of 2468	2844	rundll32.exe	f76339e.exe
PID 2844 wrote to memory of 2468	2844	rundll32.exe	f76339e.exe
PID 2844 wrote to memory of 2468	2844	rundll32.exe	f76339e.exe
PID 2864 wrote to memory of 1116	2864	f7617c5.exe	taskhost.exe
PID 2864 wrote to memory of 1168	2864	f7617c5.exe	Dwm.exe
PID 2864 wrote to memory of 1232	2864	f7617c5.exe	Explorer.EXE
PID 2864 wrote to memory of 2648	2864	f7617c5.exe	f76195a.exe
PID 2864 wrote to memory of 2648	2864	f7617c5.exe	f76195a.exe
PID 2864 wrote to memory of 2468	2864	f7617c5.exe	f76339e.exe
PID 2864 wrote to memory of 2468	2864	f7617c5.exe	f76339e.exe
PID 2648 wrote to memory of 1116	2648	f76195a.exe	taskhost.exe
PID 2648 wrote to memory of 1168	2648	f76195a.exe	Dwm.exe
PID 2648 wrote to memory of 1232	2648	f76195a.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f76195a.exef7617c5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f76195a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7617c5.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9f3315d8f65e8dad8f5a34b32f440b9f205520c9c371a46d2ff541127ce3350.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9f3315d8f65e8dad8f5a34b32f440b9f205520c9c371a46d2ff541127ce3350.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Local\Temp\f7617c5.exe
C:\Users\Admin\AppData\Local\Temp\f7617c5.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2864

C:\Users\Admin\AppData\Local\Temp\f76195a.exe
C:\Users\Admin\AppData\Local\Temp\f76195a.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2648

C:\Users\Admin\AppData\Local\Temp\f76339e.exe
C:\Users\Admin\AppData\Local\Temp\f76339e.exe
4⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2176

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
d6d47e494b646d4ae4394ccb2bf191de

SHA1
10e50fbced9a96bbb3e1034183fb3ea3726bef51

SHA256
be597eee5e68511dc8b7aacb2fccdc05681e03fa4650734e360877401407bb79

SHA512
a67f3e71a5e768fd79e8d9a070f3085260181ed5ded6f8974a7519f5383a7e3aa1f66b3396882dc7b9fa8bd8de28a925915813cb060479e944bb3c33ac5e1148

Download Submit
\Users\Admin\AppData\Local\Temp\f7617c5.exe
Filesize
97KB

MD5
d67e661dc6811bd879c66e2cc582d138

SHA1
33f4d6782ff4c2cd04da003c6e2a8a4443e5202c

SHA256
2af2865aa8c006d8cf2f9979abf3ecff23e044252685616355c9b5bb164097a1

SHA512
acd496c7c0939e72e6e062d7f39e6a37b498d8565e07057d9dfe197fa0291095b8de295c5c3e9e6d2e5b3d815325a96e32f7fc5ee01222c250c8595d6b7a7cd8

Download Submit
memory/1116-29-0x0000000001F90000-0x0000000001F92000-memory.dmp

Filesize
8KB

Download
memory/2468-79-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2468-186-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2468-102-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2468-101-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2468-104-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2648-94-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2648-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2648-103-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2648-182-0x0000000000970000-0x0000000001A2A000-memory.dmp

Filesize
16.7MB

Download
memory/2648-160-0x0000000000970000-0x0000000001A2A000-memory.dmp

Filesize
16.7MB

Download
memory/2648-181-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2648-95-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2844-38-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2844-37-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2844-8-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2844-78-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2844-40-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2844-9-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2844-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2844-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2844-57-0x00000000009A0000-0x00000000009B2000-memory.dmp

Filesize
72KB

Download
memory/2844-55-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2864-48-0x00000000002C0000-0x00000000002C2000-memory.dmp

Filesize
8KB

Download
memory/2864-19-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-62-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-63-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-64-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-66-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-60-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-16-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-80-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-81-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-83-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-85-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-17-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-61-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-23-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-46-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2864-21-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-20-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-105-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-115-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-124-0x00000000002C0000-0x00000000002C2000-memory.dmp

Filesize
8KB

Download
memory/2864-147-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2864-148-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-14-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-22-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-18-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-15-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2864-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads