sality | ddf559b3ff64dd4f97fbcdb714bdd5080dee3ec2e05490e02639c4ade47a234c

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddf559b3ff64dd4f97fbcdb714bdd5080dee3ec2e05490e02639c4ade47a234c.dll
Size

120KB
MD5

0dc89f9b7a17746391e7e9d921696fcb
SHA1

5ea70ee11755c803f591675c2158b1556a3da4b8
SHA256

ddf559b3ff64dd4f97fbcdb714bdd5080dee3ec2e05490e02639c4ade47a234c
SHA512

0b546c4328b00e4f8a5487dd970bf59888604f2db191fdef9ab398a7b37994f96c68906bbe3f1bdd4709abec7696bb443973ba58d590596c7e5d704a4a9bf4c0
SSDEEP

3072:wuY2rvoQC6+YzK+0kmqzJMy9PXTEPXIKY0bxEYB:xoV6+JHkDtR9PYPYP0bxEY

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e5773b9.exee578f9d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e5773b9.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5773b9.exee578f9d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578f9d.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e578f9d.exee5773b9.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578f9d.exe

Executes dropped EXE 3 IoCs

Processes:

e5773b9.exee5774f1.exee578f9d.exe

pid process

3208 e5773b9.exe
3772 e5774f1.exe
2744 e578f9d.exe

pid	process
3208	e5773b9.exe
3772	e5774f1.exe
2744	e578f9d.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3208-11-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-10-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-25-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-31-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-30-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-12-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-26-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-8-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-6-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-35-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-36-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-37-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-38-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-39-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-40-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-42-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-43-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-52-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-54-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-55-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-65-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-66-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-69-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-71-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-74-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-75-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-79-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-80-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-81-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-82-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3208-86-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/2744-131-0x0000000000B90000-0x0000000001C4A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5773b9.exee578f9d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578f9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e5773b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e578f9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5773b9.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e5773b9.exee578f9d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578f9d.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e5773b9.exe

description	ioc	process
File opened (read-only)	\??\K:	e5773b9.exe
File opened (read-only)	\??\Q:	e5773b9.exe
File opened (read-only)	\??\R:	e5773b9.exe
File opened (read-only)	\??\E:	e5773b9.exe
File opened (read-only)	\??\H:	e5773b9.exe
File opened (read-only)	\??\I:	e5773b9.exe
File opened (read-only)	\??\L:	e5773b9.exe
File opened (read-only)	\??\J:	e5773b9.exe
File opened (read-only)	\??\M:	e5773b9.exe
File opened (read-only)	\??\N:	e5773b9.exe
File opened (read-only)	\??\O:	e5773b9.exe
File opened (read-only)	\??\P:	e5773b9.exe
File opened (read-only)	\??\S:	e5773b9.exe
File opened (read-only)	\??\G:	e5773b9.exe

Drops file in Program Files directory 4 IoCs

Processes:

e5773b9.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e5773b9.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e5773b9.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e5773b9.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e5773b9.exe

Drops file in Windows directory 3 IoCs

Processes:

e5773b9.exee578f9d.exe

description ioc process

File created C:\Windows\e577417 e5773b9.exe
File opened for modification C:\Windows\SYSTEM.INI e5773b9.exe
File created C:\Windows\e57de0c e578f9d.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e5773b9.exe

pid process

3208 e5773b9.exe
3208 e5773b9.exe
3208 e5773b9.exe
3208 e5773b9.exe

description	ioc	process
File created	C:\Windows\e577417	e5773b9.exe
File opened for modification	C:\Windows\SYSTEM.INI	e5773b9.exe
File created	C:\Windows\e57de0c	e578f9d.exe

pid	process
3208	e5773b9.exe
3208	e5773b9.exe
3208	e5773b9.exe
3208	e5773b9.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e5773b9.exe

description	pid	process
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe
Token: SeDebugPrivilege	3208	e5773b9.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

rundll32.exerundll32.exee5773b9.exe

description	pid	process	target process
PID 1504 wrote to memory of 3132	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 3132	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 3132	1504	rundll32.exe	rundll32.exe
PID 3132 wrote to memory of 3208	3132	rundll32.exe	e5773b9.exe
PID 3132 wrote to memory of 3208	3132	rundll32.exe	e5773b9.exe
PID 3132 wrote to memory of 3208	3132	rundll32.exe	e5773b9.exe
PID 3208 wrote to memory of 780	3208	e5773b9.exe	fontdrvhost.exe
PID 3208 wrote to memory of 788	3208	e5773b9.exe	fontdrvhost.exe
PID 3208 wrote to memory of 336	3208	e5773b9.exe	dwm.exe
PID 3208 wrote to memory of 2556	3208	e5773b9.exe	sihost.exe
PID 3208 wrote to memory of 2592	3208	e5773b9.exe	svchost.exe
PID 3208 wrote to memory of 2680	3208	e5773b9.exe	taskhostw.exe
PID 3208 wrote to memory of 3552	3208	e5773b9.exe	Explorer.EXE
PID 3208 wrote to memory of 3660	3208	e5773b9.exe	svchost.exe
PID 3208 wrote to memory of 3856	3208	e5773b9.exe	DllHost.exe
PID 3208 wrote to memory of 3948	3208	e5773b9.exe	StartMenuExperienceHost.exe
PID 3208 wrote to memory of 4036	3208	e5773b9.exe	RuntimeBroker.exe
PID 3208 wrote to memory of 404	3208	e5773b9.exe	SearchApp.exe
PID 3208 wrote to memory of 3564	3208	e5773b9.exe	RuntimeBroker.exe
PID 3208 wrote to memory of 4216	3208	e5773b9.exe	RuntimeBroker.exe
PID 3208 wrote to memory of 1488	3208	e5773b9.exe	TextInputHost.exe
PID 3208 wrote to memory of 1504	3208	e5773b9.exe	rundll32.exe
PID 3208 wrote to memory of 3132	3208	e5773b9.exe	rundll32.exe
PID 3208 wrote to memory of 3132	3208	e5773b9.exe	rundll32.exe
PID 3132 wrote to memory of 3772	3132	rundll32.exe	e5774f1.exe
PID 3132 wrote to memory of 3772	3132	rundll32.exe	e5774f1.exe
PID 3132 wrote to memory of 3772	3132	rundll32.exe	e5774f1.exe
PID 3132 wrote to memory of 2744	3132	rundll32.exe	e578f9d.exe
PID 3132 wrote to memory of 2744	3132	rundll32.exe	e578f9d.exe
PID 3132 wrote to memory of 2744	3132	rundll32.exe	e578f9d.exe
PID 3208 wrote to memory of 780	3208	e5773b9.exe	fontdrvhost.exe
PID 3208 wrote to memory of 788	3208	e5773b9.exe	fontdrvhost.exe
PID 3208 wrote to memory of 336	3208	e5773b9.exe	dwm.exe
PID 3208 wrote to memory of 2556	3208	e5773b9.exe	sihost.exe
PID 3208 wrote to memory of 2592	3208	e5773b9.exe	svchost.exe
PID 3208 wrote to memory of 2680	3208	e5773b9.exe	taskhostw.exe
PID 3208 wrote to memory of 3552	3208	e5773b9.exe	Explorer.EXE
PID 3208 wrote to memory of 3660	3208	e5773b9.exe	svchost.exe
PID 3208 wrote to memory of 3856	3208	e5773b9.exe	DllHost.exe
PID 3208 wrote to memory of 3948	3208	e5773b9.exe	StartMenuExperienceHost.exe
PID 3208 wrote to memory of 4036	3208	e5773b9.exe	RuntimeBroker.exe
PID 3208 wrote to memory of 404	3208	e5773b9.exe	SearchApp.exe
PID 3208 wrote to memory of 3564	3208	e5773b9.exe	RuntimeBroker.exe
PID 3208 wrote to memory of 4216	3208	e5773b9.exe	RuntimeBroker.exe
PID 3208 wrote to memory of 1488	3208	e5773b9.exe	TextInputHost.exe
PID 3208 wrote to memory of 3772	3208	e5773b9.exe	e5774f1.exe
PID 3208 wrote to memory of 3772	3208	e5773b9.exe	e5774f1.exe
PID 3208 wrote to memory of 2744	3208	e5773b9.exe	e578f9d.exe
PID 3208 wrote to memory of 2744	3208	e5773b9.exe	e578f9d.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e5773b9.exee578f9d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5773b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578f9d.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2592

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3552

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddf559b3ff64dd4f97fbcdb714bdd5080dee3ec2e05490e02639c4ade47a234c.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddf559b3ff64dd4f97fbcdb714bdd5080dee3ec2e05490e02639c4ade47a234c.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:3132

C:\Users\Admin\AppData\Local\Temp\e5773b9.exe
C:\Users\Admin\AppData\Local\Temp\e5773b9.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3208

C:\Users\Admin\AppData\Local\Temp\e5774f1.exe
C:\Users\Admin\AppData\Local\Temp\e5774f1.exe
4⤵
- Executes dropped EXE
PID:3772

C:\Users\Admin\AppData\Local\Temp\e578f9d.exe
C:\Users\Admin\AppData\Local\Temp\e578f9d.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3660

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3856

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3948

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4036

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:404

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4216

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1488

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e5773b9.exe
Filesize
97KB

MD5
eaa5e1d1ecda27ec55a425b796bf1be5

SHA1
c5ef3173b285920a4c1a286cca28db5bdd556836

SHA256
f824decdf7f216d5b26c4017ad2bac5e987e871fc27ea40659c2b705f1b838e9

SHA512
24b97d70c44756d5ddba35aca72af2417640d033b316aec65f7e21d056d8dc173eac72d4098d1573d21542f6d58697d587d4a06c59a0c228f2dd8c8bc48164c5

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
9f04378f47831ccc8b870ef45eb64044

SHA1
9b4577704d5f630507307e46fcdca5677e27d940

SHA256
145fd861dc92aa1032b5ebfef42b85a18573f041fed32d54308710712fe43846

SHA512
0b5ff073245e9914cd797ce3f018b767c98053ae475b47309eda7ecd8731688098c62d04cf77984cb93883d9ee457f5eaa9ca8371a59e5ac8bbfa930e7078d52

Download Submit
memory/2744-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2744-131-0x0000000000B90000-0x0000000001C4A000-memory.dmp

Filesize
16.7MB

Download
memory/2744-130-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2744-132-0x0000000000B90000-0x0000000001C4A000-memory.dmp

Filesize
16.7MB

Download
memory/2744-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2744-61-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2744-51-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3132-13-0x0000000004420000-0x0000000004422000-memory.dmp

Filesize
8KB

Download
memory/3132-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3132-19-0x0000000004420000-0x0000000004422000-memory.dmp

Filesize
8KB

Download
memory/3132-27-0x0000000004420000-0x0000000004422000-memory.dmp

Filesize
8KB

Download
memory/3132-14-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/3208-42-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-80-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-16-0x0000000003E70000-0x0000000003E71000-memory.dmp

Filesize
4KB

Download
memory/3208-8-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-6-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-35-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-36-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-37-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-38-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-39-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-40-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-12-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-43-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-30-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-52-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-54-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-55-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3208-11-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-31-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-25-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-10-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-29-0x0000000001B30000-0x0000000001B32000-memory.dmp

Filesize
8KB

Download
memory/3208-65-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-66-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-69-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-71-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-74-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-75-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-76-0x0000000001B30000-0x0000000001B32000-memory.dmp

Filesize
8KB

Download
memory/3208-79-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-26-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-81-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-82-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-86-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3208-102-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3772-106-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3772-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/3772-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3772-58-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3772-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download